Analysis
- max time kernel
135s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/10/2024, 05:49
General
- Target 3e263a24122e03e6793a491bfda7942a_JaffaCakes118.exe
- Size 5.6MB
- Sample241013-gjc6vswepl
- SHA256 d0b4b43432238e361c9f553caa05df5c34c462d55bb18a6db5e076faaaf05da9
Malware Config
Signatures
- NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e263a24122e03e6793a491bfda7942a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e263a24122e03e6793a491bfda7942a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Plib.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Plib.exe" /VERYSILENT /SP-2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0L7LU.tmp\Plib.tmp"C:\Users\Admin\AppData\Local\Temp\is-0L7LU.tmp\Plib.tmp" /SL5="$B0052,2331902,780800,C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Plib.exe" /VERYSILENT /SP-3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSpo\WCL.exe"C:\Users\Admin\AppData\Roaming\WinSpo\WCL.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\WinSpo\svschost.exe"C:\Users\Admin\AppData\Roaming\WinSpo\svschost.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PlotManage.exe"C:\Users\Admin\AppData\Local\Temp\PlotManage.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 &Del "3e263a24122e03e6793a491bfda7942a_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 13⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PMGR.exe
Plib.exe
Plib.tmp
is-003M6.tmp
is-2VS18.tmp
is-7BH44.tmp
is-8R0FR.tmp
is-BKJ98.tmp
is-EU18T.tmp
is-FC4VD.tmp
is-FHHTL.tmp
is-I8POJ.tmp
is-RH4VJ.tmp
is-RH891.tmp
is-RNCKP.tmp
is-RUCQL.tmp
is-TKC74.tmp
is-V9A52.tmp
memory/224-188-0x000000000BFD0000-0x000000000BFD8000-memory.dmp
memory/224-191-0x0000000005770000-0x0000000005778000-memory.dmp
memory/224-192-0x0000000074D5E000-0x0000000074D5F000-memory.dmp
memory/224-41-0x0000000005090000-0x00000000050E0000-memory.dmp
memory/224-178-0x0000000008C30000-0x0000000008C6C000-memory.dmp
memory/224-177-0x0000000009340000-0x00000000098E4000-memory.dmp
memory/224-34-0x0000000074D5E000-0x0000000074D5F000-memory.dmp
memory/224-158-0x0000000008830000-0x00000000088EA000-memory.dmp
memory/224-40-0x0000000007AE0000-0x00000000082B8000-memory.dmp
memory/224-72-0x00000000083C0000-0x0000000008430000-memory.dmp
memory/224-73-0x00000000084D0000-0x0000000008562000-memory.dmp
memory/224-189-0x000000000C430000-0x000000000C468000-memory.dmp
memory/224-38-0x0000000000A90000-0x0000000000DCA000-memory.dmp
memory/224-190-0x000000000BFE0000-0x000000000BFEE000-memory.dmp
memory/324-179-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/1160-33-0x0000000000401000-0x00000000004B7000-memory.dmp
memory/1160-29-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1160-183-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/2224-181-0x00000204B7BD0000-0x00000204B7BD8000-memory.dmp
memory/4960-0-0x00007FFEBC773000-0x00007FFEBC775000-memory.dmp
memory/4960-2-0x00007FFEBC770000-0x00007FFEBD231000-memory.dmp
memory/4960-3-0x00007FFEBC770000-0x00007FFEBD231000-memory.dmp
memory/4960-4-0x0000020FF1A80000-0x0000020FF20BC000-memory.dmp
memory/4960-32-0x00007FFEBC770000-0x00007FFEBD231000-memory.dmp
memory/4960-1-0x0000020FD6FB0000-0x0000020FD7554000-memory.dmp