Analysis
- max time kernel
148s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
02/11/2024, 17:18
General
- Target 869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe
- Size 334KB
- Sample241102-vvmfkaznat
- SHA256 a9b1cf763a44f0cd8f59ff3178b19544216dc482aa47bbc7b83b5b26eda5e6aa
Malware Config
Signatures
- Contacts a large (16403) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 1 IoCs
- Modifies Control Panel 4 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B965DA44-BA2B-5232-B6E1-2553B5BB2851}\autoconv.exe"C:\Users\Admin\AppData\Roaming\{B965DA44-BA2B-5232-B6E1-2553B5BB2851}\autoconv.exe"2⤵
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe" > NUL2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "869e516b99f01a39f9ee0aa9e404fcbf_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
autoconv.lnk
autoconv.exe
memory/1144-29-0x0000000000400000-0x00000000005C9000-memory.dmp
memory/1144-27-0x0000000000400000-0x00000000005C9000-memory.dmp
memory/1144-26-0x0000000000400000-0x00000000005C9000-memory.dmp
memory/1144-24-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1144-20-0x0000000000400000-0x00000000005C9000-memory.dmp
memory/3772-4-0x0000000000720000-0x0000000000721000-memory.dmp
memory/3772-8-0x0000000000400000-0x00000000005C9000-memory.dmp
memory/3772-7-0x0000000000720000-0x0000000000721000-memory.dmp
memory/3772-19-0x0000000000400000-0x00000000005C9000-memory.dmp
memory/3772-5-0x00000000026E0000-0x0000000002730000-memory.dmp
memory/3772-6-0x0000000000720000-0x0000000000721000-memory.dmp
memory/3772-0-0x00000000026E0000-0x0000000002730000-memory.dmp
memory/3772-3-0x0000000000720000-0x0000000000721000-memory.dmp
memory/3772-2-0x0000000000720000-0x0000000000721000-memory.dmp
memory/3772-1-0x0000000000720000-0x0000000000721000-memory.dmp