Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/10/2024, 15:08
General
- Target 5d3a49e46089ba814b5a812ab21f3d0b_JaffaCakes118.exe
- Size 1.9MB
- Sample241019-sh5ehasdkd
- SHA256 d23a9cc7e9362cb857713813715ea5ede562f4e2f0c541d39b289b8fc5b278c3
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d3a49e46089ba814b5a812ab21f3d0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d3a49e46089ba814b5a812ab21f3d0b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WORLDW~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WORLDW~1.EXE2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\server.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\server.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WORLDW~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WORLDW~1.EXE3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WORLDW~1.EXE
server.exe
WORLDW~1.EXE
server.exe
memory/2624-541-0x000000001BE40000-0x000000001C30E000-memory.dmp
memory/2624-542-0x000000001B920000-0x000000001B934000-memory.dmp
memory/2624-550-0x000000001D0C0000-0x000000001D0E2000-memory.dmp
memory/2624-549-0x000000001CA60000-0x000000001CAAC000-memory.dmp
memory/2624-548-0x000000001B800000-0x000000001B808000-memory.dmp
memory/2624-547-0x000000001C870000-0x000000001C90C000-memory.dmp
memory/2624-546-0x000000001C720000-0x000000001C7C6000-memory.dmp
memory/2624-545-0x000000001C500000-0x000000001C674000-memory.dmp
memory/3932-41-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-13-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-133-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-132-0x0000000077A12000-0x0000000077A13000-memory.dmp
memory/3932-131-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-122-0x0000000077A12000-0x0000000077A13000-memory.dmp
memory/3932-121-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-103-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-67-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-63-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-61-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-57-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-51-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-49-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-47-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-45-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-143-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-266-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-40-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-37-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-33-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-29-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-17-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-137-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-9-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-65-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-59-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-55-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-53-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-43-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-35-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-31-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-27-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-25-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-23-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-21-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-148-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-150-0x0000000077A12000-0x0000000077A13000-memory.dmp
memory/3932-104-0x0000000077A12000-0x0000000077A13000-memory.dmp
memory/3932-69-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-71-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-7-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-19-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-15-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-11-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-8-0x0000000000590000-0x00000000005E2000-memory.dmp
memory/3932-268-0x0000000000590000-0x00000000005E2000-memory.dmp