Analysis
- max time kernel
96s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 15:59
General
- Target a660c46ffb2ff8c8a624d9a9ebffb4c6_JaffaCakes118.exe
- Size 675KB
- Sample240613-te2d4svgre
- SHA256 15b577d5199e4a88ec23f15c26f43fd0ec018376e614f3cbc0f83c80dea83ea9
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a660c46ffb2ff8c8a624d9a9ebffb4c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a660c46ffb2ff8c8a624d9a9ebffb4c6_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n1260\s1260.exe"C:\Users\Admin\AppData\Local\Temp\n1260\s1260.exe" a86fbb083eaaa706bcedcd00OI7+F4zv2Yjg/s0AmO5XzWPcE3js3E1SHEWEQp32fZ3Au9fwsPNFpjI+wG/G6nkA9a0JmKlXpR5wdTTyJdDW5hEDR5OCEkr5DcdR4apzAVKQpn3LxJrOaZrkhwJYpkYBvuO9bPMdI5H0dKaK70kNsvXL6UdPgRwBdPrupd9g /v "C:\Users\Admin\AppData\Local\Temp\a660c46ffb2ff8c8a624d9a9ebffb4c6_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s1260.exe
memory/2096-12-0x00007FF8EF1F5000-0x00007FF8EF1F6000-memory.dmp
memory/2096-13-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-14-0x00007FF8EF1F5000-0x00007FF8EF1F6000-memory.dmp
memory/2096-15-0x000000001BF90000-0x000000001BFA0000-memory.dmp
memory/2096-18-0x000000001CF70000-0x000000001D43E000-memory.dmp
memory/2096-19-0x000000001D440000-0x000000001D4DC000-memory.dmp
memory/2096-20-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-21-0x000000001D5D0000-0x000000001D632000-memory.dmp
memory/2096-22-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-23-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-24-0x000000001C460000-0x000000001C468000-memory.dmp
memory/2096-25-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-26-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-27-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-28-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-29-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp
memory/2096-30-0x0000000021340000-0x000000002184E000-memory.dmp
memory/2096-32-0x00007FF8EEF40000-0x00007FF8EF8E1000-memory.dmp