Analysis
- max time kernel
91s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 09:25
General
- Target a4d667e3bfcc5643c79f8f0dcd698aa4_JaffaCakes118.exe
- Size 673KB
- Sample240613-ldmwbssfpg
- SHA256 14eff4327fd0066cab705dc7ae90e42ad8b1579702fa8d15989a8fc24687066f
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4d667e3bfcc5643c79f8f0dcd698aa4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4d667e3bfcc5643c79f8f0dcd698aa4_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n2395\s2395.exe"C:\Users\Admin\AppData\Local\Temp\n2395\s2395.exe" 3534426b5ea2608668cd5ac9jknJcNaCIDGpY3G2RvPeBumVxxEb7RF3K33+lgwt6LUtdKBYtJqSiZq4EzHYKKT9DUnXzXLlD547wouBwMkfwRsasFoBXJ46AEXOiuZqPWezHlM7Xf7JeXjIDoY+nuQbrI2AQB6AtkkGU4GoAWJCMxhnA9IO7hanc7uVq6Ga /v "C:\Users\Admin\AppData\Local\Temp\a4d667e3bfcc5643c79f8f0dcd698aa4_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s2395.exe
memory/4856-12-0x00007FF8F8EF5000-0x00007FF8F8EF6000-memory.dmp
memory/4856-13-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-27-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
memory/4856-30-0x000000001C000000-0x000000001C4CE000-memory.dmp
memory/4856-31-0x000000001C570000-0x000000001C60C000-memory.dmp
memory/4856-32-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-33-0x000000001C760000-0x000000001C7C2000-memory.dmp
memory/4856-34-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-35-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-36-0x000000001B600000-0x000000001B608000-memory.dmp
memory/4856-37-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-38-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-39-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-40-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-41-0x000000001FD10000-0x000000001FE4C000-memory.dmp
memory/4856-42-0x0000000020360000-0x000000002086E000-memory.dmp
memory/4856-43-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-44-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-45-0x00007FF8F8EF5000-0x00007FF8F8EF6000-memory.dmp
memory/4856-46-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-47-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp
memory/4856-49-0x00007FF8F8C40000-0x00007FF8F95E1000-memory.dmp