Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/06/2024, 15:36
General
- Target a649da1e2fb17d5d7740d6175e5f618a_JaffaCakes118.exe
- Size 512KB
- Sample240613-s16qaavckf
- SHA256 1169d3880ddbb14dc5ba51cc58bc1ce704cfffaf6ebcb61d06fa90a4ecbdcf9d
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a649da1e2fb17d5d7740d6175e5f618a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a649da1e2fb17d5d7740d6175e5f618a_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n9652\s9652.exe"C:\Users\Admin\AppData\Local\Temp\n9652\s9652.exe" 0db47b863ce824d5cb965393QFevqGZ6ruaaLSgDXCyLuUDEqp3E/oB6+N9wzTWVbfWFD9QgWIQVYCP+XYlVf/XUdxOCxBv52IVlsIaad6lSdXvxIAMe39ZV0KU5n+n3z0JUf+Q+mBYNwd9K/0x1JaQUCYu/VblLz2eukx9S5Sudu/w= /v "C:\Users\Admin\AppData\Local\Temp\a649da1e2fb17d5d7740d6175e5f618a_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s9652.exe
memory/1972-12-0x00007FFE8AEF5000-0x00007FFE8AEF6000-memory.dmp
memory/1972-13-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-14-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-28-0x0000000000D10000-0x0000000000D22000-memory.dmp
memory/1972-31-0x000000001C170000-0x000000001C63E000-memory.dmp
memory/1972-32-0x000000001C6E0000-0x000000001C77C000-memory.dmp
memory/1972-33-0x000000001C840000-0x000000001C8A2000-memory.dmp
memory/1972-34-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-35-0x000000001B3E0000-0x000000001B3E8000-memory.dmp
memory/1972-36-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-37-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-38-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-39-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-40-0x00000000202B0000-0x00000000207BE000-memory.dmp
memory/1972-41-0x0000000020A00000-0x0000000020B3C000-memory.dmp
memory/1972-42-0x00007FFE8AEF5000-0x00007FFE8AEF6000-memory.dmp
memory/1972-43-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp
memory/1972-45-0x00007FFE8AC40000-0x00007FFE8B5E1000-memory.dmp