Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 18:00

General

  • Target

    ecb5faaf15a75e66857d0cdfe936c45e_JaffaCakes118.exe

  • Size

    61KB

  • MD5

    ecb5faaf15a75e66857d0cdfe936c45e

  • SHA1

    2a6b69c095963a76b29b78509d58f586a5c0ee68

  • SHA256

    6546f0638160cb590b4ead2401fb55d48e10b2ee1808ff0354fff52c9e2f62bf

  • SHA512

    bdbd9e290d443314b255b183610c4d7ab4fcd783d008f1506636ffe2163f749f0624426239e2f842b3308df84f103154d531f33503eae74a873c197651c25125

  • SSDEEP

    768:wKsMqCXfVcWMHM9ZkiANIUZBOYLDwUzc80gmq3oP/oDe:wKse0M9ZkiAPZ9r/0O8/oy

Malware Config

Signatures

  • Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

  • Nitro family
  • Renames multiple (87) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecb5faaf15a75e66857d0cdfe936c45e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ecb5faaf15a75e66857d0cdfe936c45e_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4080-0-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

    Filesize

    4KB

  • memory/4080-1-0x0000000000800000-0x0000000000816000-memory.dmp

    Filesize

    88KB

  • memory/4080-2-0x0000000005670000-0x0000000005C14000-memory.dmp

    Filesize

    5.6MB

  • memory/4080-3-0x00000000051C0000-0x0000000005252000-memory.dmp

    Filesize

    584KB

  • memory/4080-4-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-25-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

    Filesize

    4KB

  • memory/4080-29-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-96-0x0000000005F60000-0x0000000005F6A000-memory.dmp

    Filesize

    40KB

  • memory/4080-97-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-98-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-99-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-100-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB