Analysis
- max time kernel
144s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 02:38
General
- Target a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118.exe
- Size 2.0MB
- Sample240613-c4vjes1frd
- SHA256 a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4
Malware Config
Signatures
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD3EA0.tmp.1718246301\HTA\index.hta?utorrent" "C:\Users\Admin\AppData\Local\Temp\a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118.exe" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD3EA0.tmp.1718246301\index.hta.log" /PID "3832" /CID "S_TVlPipzmHcX598" /VERSION "111915656" /BUCKET "0" /SSB "2" /COUNTRY "US" /OS "10.0" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-4204450073-1267028356-951339405-1000" /CLIENT "utorrent"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 8243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5116 -ip 51161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
main_utorrent.ico
index.hta
install.1718246301.zip
common.js
initialize.js
install.js
common.css
settings.dat.old
toolbar.benc.new
memory/3832-91-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-89-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-90-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-0-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-92-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-93-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-94-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-95-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-96-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-97-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-98-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-99-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-100-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-101-0x0000000000400000-0x0000000000949000-memory.dmp
memory/3832-102-0x0000000000400000-0x0000000000949000-memory.dmp