Analysis
- max time kernel
150s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
27/06/2024, 08:30
General
- Target 1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
- Size 47KB
- Sample240627-kekxpathlp
- SHA256 6f48ee57a66e9beac78c2ee53b9adb57abb0bc42231877a5d73c8a039e35e287
Malware Config
Signatures
- Possible privilege escalation attempt 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /f "C:\Windows\System32\rstrui.exe"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\Windows\System32\rstrui.exe" /grant Admin:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "C:\Windows\System32\rstrui.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\wlock\wlock.exe"C:\Users\Admin\wlock\wlock.exe" f2⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wlock.exe
memory/2760-0-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2760-7-0x0000000002050000-0x0000000002051000-memory.dmp
memory/2760-8-0x0000000002050000-0x0000000002051000-memory.dmp
memory/2760-212-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2760-223-0x0000000002050000-0x0000000002051000-memory.dmp
memory/4108-14-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-12-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-11-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-15-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-22-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-21-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-27-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-72-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/4108-71-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/4108-70-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/4108-69-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/4108-68-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-26-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-25-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-24-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-23-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-20-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-19-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-18-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-17-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/4108-154-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-153-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-152-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-151-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-150-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-149-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-148-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-147-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-146-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-145-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-144-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-143-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-142-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-141-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-140-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-139-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-138-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-137-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-136-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-135-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-134-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-133-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-132-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-131-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-130-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-129-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-128-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-127-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-126-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-125-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-124-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-123-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-122-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-232-0x0000000000990000-0x0000000000991000-memory.dmp
memory/4108-253-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-252-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/4108-293-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-296-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-295-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-294-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-292-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-291-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-290-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-289-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-288-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-287-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-286-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-285-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-284-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-283-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-282-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-281-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-280-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-279-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-278-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-277-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-276-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-275-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-274-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-273-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-272-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-271-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-270-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-269-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-268-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-267-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-266-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-265-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/4108-264-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/4108-307-0x0000000000D40000-0x0000000000D41000-memory.dmp