Analysis
- max time kernel
141s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/09/2024, 04:10
General
- Target ce9e9fa271c49db863e26c410184b42a_JaffaCakes118.exe
- Size 372KB
- Sample240906-erenjsvgrl
- SHA256 1e2f35487d928d5d1c5078d7fc7bd6667bd6f009c2d841dbb0efd9eb8a47d20d
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce9e9fa271c49db863e26c410184b42a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce9e9fa271c49db863e26c410184b42a_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\Norton\{NAV_prod_UPG_1.5.30_18.1.0.37}\ce9e9fa271c49db863e26c410184b42a_JaffaCakes118.exeC:\Users\Public\Downloads\Norton\{NAV_prod_UPG_1.5.30_18.1.0.37}\ce9e9fa271c49db863e26c410184b42a_JaffaCakes118.exe /r2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
LC.INI
4bd07e1ba952c6aa9bf83a8d98c08949_c186ecc3-67e4-4d2b-8682-b6c322da87aa
Norton Installation Files.lnk
ce9e9fa271c49db863e26c410184b42a_JaffaCakes118.exe
memory/376-24-0x0000000000400000-0x0000000000543000-memory.dmp
memory/376-0-0x0000000000400000-0x0000000000543000-memory.dmp
memory/376-1-0x00000000006B0000-0x00000000006B2000-memory.dmp
memory/3632-25-0x0000000000680000-0x0000000000682000-memory.dmp
memory/3632-36-0x0000000002260000-0x0000000002261000-memory.dmp
memory/3632-38-0x0000000000680000-0x0000000000682000-memory.dmp
memory/3632-40-0x0000000002260000-0x0000000002261000-memory.dmp
memory/3632-39-0x0000000000400000-0x0000000000543000-memory.dmp