Analysis
- max time kernel
95s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
24/09/2024, 18:44
General
- Target f447d7a2f7cfb24db6b3c42716b16457_JaffaCakes118.exe
- Size 239KB
- Sample240924-xdsblascmd
- SHA256 67c08d2a21a3ade47ed790aa65ef7cbb117e32300b432f5be97d5ff13c745247
Malware Config
Extracted
-
buer
-
https://104.248.83.13/
Signatures
- Buer
Buer is a new modular loader first seen in August 2019.
- Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f447d7a2f7cfb24db6b3c42716b16457_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f447d7a2f7cfb24db6b3c42716b16457_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\6faec8ef1be897ef7497}"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 12082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2320 -ip 23201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_h324fhbg.xpj.ps1
memory/2320-4-0x00000000005A0000-0x00000000005AD000-memory.dmp
memory/2320-6-0x0000000040000000-0x000000004000C000-memory.dmp
memory/2320-0-0x0000000000750000-0x000000000075F000-memory.dmp
memory/4896-27-0x00000000061D0000-0x000000000621C000-memory.dmp
memory/4896-28-0x00000000070B0000-0x00000000070E2000-memory.dmp
memory/4896-11-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4896-12-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4896-13-0x0000000005650000-0x0000000005672000-memory.dmp
memory/4896-15-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/4896-14-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/4896-9-0x0000000004920000-0x0000000004956000-memory.dmp
memory/4896-22-0x00000000057D0000-0x0000000005B24000-memory.dmp
memory/4896-26-0x0000000005EC0000-0x0000000005EDE000-memory.dmp
memory/4896-8-0x000000007446E000-0x000000007446F000-memory.dmp
memory/4896-30-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4896-29-0x0000000070300000-0x000000007034C000-memory.dmp
memory/4896-10-0x0000000004FD0000-0x00000000055F8000-memory.dmp
memory/4896-41-0x0000000074460000-0x0000000074C10000-memory.dmp
memory/4896-40-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/4896-42-0x00000000070F0000-0x0000000007193000-memory.dmp
memory/4896-44-0x0000000007210000-0x000000000722A000-memory.dmp
memory/4896-43-0x0000000007860000-0x0000000007EDA000-memory.dmp
memory/4896-45-0x0000000007270000-0x000000000727A000-memory.dmp
memory/4896-46-0x00000000074A0000-0x0000000007536000-memory.dmp
memory/4896-47-0x0000000007410000-0x0000000007421000-memory.dmp
memory/4896-48-0x0000000007440000-0x000000000744E000-memory.dmp
memory/4896-49-0x0000000007450000-0x0000000007464000-memory.dmp
memory/4896-50-0x0000000007560000-0x000000000757A000-memory.dmp
memory/4896-51-0x0000000007490000-0x0000000007498000-memory.dmp
memory/4896-54-0x0000000074460000-0x0000000074C10000-memory.dmp