Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 06:39

General

  • Target

    a064b524a661ce56c911fb3b184c1b8d_JaffaCakes118.exe

  • Size

    61KB

  • MD5

    a064b524a661ce56c911fb3b184c1b8d

  • SHA1

    a39aaf5834308ce443b56d80b7cf28ad9eb8f2f2

  • SHA256

    3d782b5f5304e058161dce64bf27fc5c28af23675ce6db1fc46386fb8f532c2b

  • SHA512

    397fd0aa5e5bbb37e2cc703a81335eabdeada48fde13e100b876e7fcd3c79218dc59e533f000e7dbb1e0dc9986d98617249d327c42e9c5b19f7aeb4e2f0a238b

  • SSDEEP

    768:gnbyhKtnWoRxqf7GNI4r8YLDwUzc80gmq3oP/oDY:gnbRw7Gxpr/0O8/ok

Malware Config

Signatures

  • Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

  • Nitro family
  • Renames multiple (89) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 5 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a064b524a661ce56c911fb3b184c1b8d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a064b524a661ce56c911fb3b184c1b8d_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2588-0-0x00000000753AE000-0x00000000753AF000-memory.dmp

    Filesize

    4KB

  • memory/2588-1-0x0000000000B20000-0x0000000000B36000-memory.dmp

    Filesize

    88KB

  • memory/2588-2-0x0000000005990000-0x0000000005F34000-memory.dmp

    Filesize

    5.6MB

  • memory/2588-3-0x00000000054E0000-0x0000000005572000-memory.dmp

    Filesize

    584KB

  • memory/2588-4-0x00000000753A0000-0x0000000075B50000-memory.dmp

    Filesize

    7.7MB

  • memory/2588-29-0x00000000753AE000-0x00000000753AF000-memory.dmp

    Filesize

    4KB

  • memory/2588-31-0x00000000753A0000-0x0000000075B50000-memory.dmp

    Filesize

    7.7MB

  • memory/2588-98-0x0000000006240000-0x000000000624A000-memory.dmp

    Filesize

    40KB

  • memory/2588-99-0x00000000753A0000-0x0000000075B50000-memory.dmp

    Filesize

    7.7MB

  • memory/2588-100-0x00000000753A0000-0x0000000075B50000-memory.dmp

    Filesize

    7.7MB

  • memory/2588-101-0x00000000753A0000-0x0000000075B50000-memory.dmp

    Filesize

    7.7MB

  • memory/2588-102-0x00000000753A0000-0x0000000075B50000-memory.dmp

    Filesize

    7.7MB