Analysis
- max time kernel
96s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/06/2024, 03:42
General
- Target a7e3c82d153918f4058e12c3ae1e9438_JaffaCakes118.exe
- Size 664KB
- Sample240614-d9geestfpb
- SHA256 1523dad9e4ee05902e734e4584cb5f2139fdaa951fff48c1fca724825aa4e12b
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7e3c82d153918f4058e12c3ae1e9438_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7e3c82d153918f4058e12c3ae1e9438_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n7982\s7982.exe"C:\Users\Admin\AppData\Local\Temp\n7982\s7982.exe" 9a5f8b781e2de0f2229151d6lAe2OGSsInzZcHbNeVFfQDulJaKs6hcbZVhchNVVNW4MeBgdjpSbiS2pv7rYcSOAQcAZhR0dauMujn40rH2SCA4pZhzq0wzON9+Izyw86c1GRaZqy/TWFzWpUfXiF3t9EcBp5119HP+RjHCEFxgzSLm4mSC3sybro3/5KP0= /v "C:\Users\Admin\AppData\Local\Temp\a7e3c82d153918f4058e12c3ae1e9438_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s7982.exe
memory/1728-12-0x00007FFE31515000-0x00007FFE31516000-memory.dmp
memory/1728-13-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-14-0x00007FFE31515000-0x00007FFE31516000-memory.dmp
memory/1728-15-0x000000001B810000-0x000000001B820000-memory.dmp
memory/1728-18-0x000000001C230000-0x000000001C6FE000-memory.dmp
memory/1728-19-0x000000001C7A0000-0x000000001C83C000-memory.dmp
memory/1728-20-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-21-0x000000001C990000-0x000000001C9F2000-memory.dmp
memory/1728-22-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-23-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-24-0x000000001BD00000-0x000000001BD08000-memory.dmp
memory/1728-25-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-26-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-27-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-28-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-29-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp
memory/1728-30-0x0000000020C00000-0x000000002110E000-memory.dmp
memory/1728-32-0x00007FFE31260000-0x00007FFE31C01000-memory.dmp