Analysis
- max time kernel
92s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 12:02
General
- Target a56f34f1ab9beb4f37bd74b18f13ad52_JaffaCakes118.exe
- Size 666KB
- Sample240613-n7mtjasanp
- SHA256 1093550cf992906c6c754831743bb0639d29a103852580f73fa9d8b32912a2f1
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a56f34f1ab9beb4f37bd74b18f13ad52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a56f34f1ab9beb4f37bd74b18f13ad52_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n438\s438.exe"C:\Users\Admin\AppData\Local\Temp\n438\s438.exe" f86134d3ae4dafca12100df9HEuXCq6i/cR1C+RQwAH+y3pjAS8Y7mR0qF63JHpYd7AgZjFFnphxOT41ediqf7O1VlAhw50shQup3lbNaxxD/HuGt65s5O5RONPjZHHJZNGnJOPjwEDgIHjGmlWVgs4u/LVAFH9IOtDxVSmrM1EU/1GQuO0lmSGy3j17/X+X /v "C:\Users\Admin\AppData\Local\Temp\a56f34f1ab9beb4f37bd74b18f13ad52_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s438.exe
memory/2400-12-0x00007FFE761E5000-0x00007FFE761E6000-memory.dmp
memory/2400-13-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-27-0x000000001B590000-0x000000001B5A0000-memory.dmp
memory/2400-30-0x000000001C060000-0x000000001C52E000-memory.dmp
memory/2400-31-0x000000001C530000-0x000000001C5CC000-memory.dmp
memory/2400-32-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-33-0x000000001C720000-0x000000001C782000-memory.dmp
memory/2400-34-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-35-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-36-0x000000001B630000-0x000000001B638000-memory.dmp
memory/2400-37-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-38-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-39-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-40-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-41-0x000000001FF60000-0x000000002009C000-memory.dmp
memory/2400-42-0x00000000205B0000-0x0000000020ABE000-memory.dmp
memory/2400-43-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-44-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp
memory/2400-46-0x00007FFE75F30000-0x00007FFE768D1000-memory.dmp