Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
14/06/2024, 04:09
General
- Target a7f58ccb312dbd23a5d2000bee283183_JaffaCakes118.exe
- Size 671KB
- Sample240614-eq6ewaydjn
- SHA256 125e3c3f79b5b7508e6761a2e37274403488bc30a69d9138c7d2d43728d0a5f8
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7f58ccb312dbd23a5d2000bee283183_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7f58ccb312dbd23a5d2000bee283183_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n3371\s3371.exe"C:\Users\Admin\AppData\Local\Temp\n3371\s3371.exe" 95bb545695b6adea26adf144ZBMUn3tUArqjBUwVa/YG9rntjuk/fTvDw0d+88aOBIGWPw7WQPHKmg4sZTs2cvKMf+OjILZe4sfckoY7em5b0LH82u40n+5DH/4NJ2fhmrh3mNvbeFnoVd/ReIWWqMSz4IAyqEjQKzroT0plHPsvdWN0g6/3UErSMp/UXOA= /v "C:\Users\Admin\AppData\Local\Temp\a7f58ccb312dbd23a5d2000bee283183_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s3371.exe
memory/1348-12-0x00007FFDB7325000-0x00007FFDB7326000-memory.dmp
memory/1348-13-0x00007FFDB7070000-0x00007FFDB7A11000-memory.dmp
memory/1348-14-0x00007FFDB7325000-0x00007FFDB7326000-memory.dmp
memory/1348-15-0x000000001BB20000-0x000000001BB30000-memory.dmp
memory/1348-18-0x000000001C550000-0x000000001CA1E000-memory.dmp
memory/1348-19-0x000000001CAC0000-0x000000001CB5C000-memory.dmp
memory/1348-20-0x00007FFDB7070000-0x00007FFDB7A11000-memory.dmp
memory/1348-21-0x000000001CCB0000-0x000000001CD12000-memory.dmp
memory/1348-22-0x00007FFDB7070000-0x00007FFDB7A11000-memory.dmp
memory/1348-23-0x00007FFDB7070000-0x00007FFDB7A11000-memory.dmp
memory/1348-24-0x00000000211B0000-0x00000000216BE000-memory.dmp
memory/1348-26-0x00007FFDB7070000-0x00007FFDB7A11000-memory.dmp