Analysis

  • max time kernel
    4s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 01:54

Errors

Reason
Machine shutdown

General

  • Target

    503b154050ce76040ccb90509af08ded_JaffaCakes118.exe

  • Size

    2.9MB

  • MD5

    503b154050ce76040ccb90509af08ded

  • SHA1

    852915fe0319821b44c14d0d8c3a888fa4345d57

  • SHA256

    b5f3f9c38941a80a482fec7f66183828add12d9115c824b78c89ffbaae951996

  • SHA512

    5a31418b3e7c1b27e910a6f664252c30d502cb550df943cef10893c1980df77ff1e06a6a0649cd8f0ab2e6c0e4fc754c4b6a8a3e508c26d00824d8ca58c2eabb

  • SSDEEP

    3072:/BvoI005zo/QmqkeYwlun+hCzqr1L8g/JcY4g0mp:ll5zo/QfP+Chwg/2g9

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\503b154050ce76040ccb90509af08ded_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\503b154050ce76040ccb90509af08ded_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Users\Admin\AppData\Local\Temp\mbr-locker.exe
      "C:\Users\Admin\AppData\Local\Temp\mbr-locker.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Local\Temp\sys3.exe
        C:\Users\Admin\AppData\Local\Temp\\sys3.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4908
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3980855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\mbr-locker.exe

          Filesize

          273KB

          MD5

          f907909c1e30c3e839096e7d4d090b2c

          SHA1

          0a99db4e4374dadbfb22610e826e68d3aa3fc376

          SHA256

          f31e5d50d7af3d92ce22acf0170943e2d825de609043ffbb8a7dd81c40a9fa9d

          SHA512

          583481e0f239587cd39c14fc4496137ffb8fdd58d8b7f37eb0fc6c720faf770aa6f9b6f1ba323e916536ff7f4594379004de3462150da973e9155b36cb65598f

        • C:\Users\Admin\AppData\Local\Temp\systm.txt

          Filesize

          48B

          MD5

          55a6c5e8b47dc0777cf286fa1b3970d2

          SHA1

          c6b51d0028b78e0a5bb019285b14e3d25478632a

          SHA256

          5389ea291b867e7beed8516a9d534fdd91bfc3802512d5bd4b7823b702ba130c

          SHA512

          d5bc859ce5592a48ac708810d7240df448c860c97f98819b4cb45cd661365946ed31553a0c017e3dd1540915b98291561e184b273f7880ff112b6fad62846782

        • memory/3548-0-0x0000000000400000-0x00000000004AA000-memory.dmp

          Filesize

          680KB

        • memory/3548-10-0x0000000000400000-0x00000000004AA000-memory.dmp

          Filesize

          680KB

        • memory/5004-9-0x000000002AA00000-0x000000002AA47000-memory.dmp

          Filesize

          284KB

        • memory/5004-18-0x000000002AA00000-0x000000002AA47000-memory.dmp

          Filesize

          284KB