Analysis
- max time kernel
141s - max time network
111s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
03/05/2025, 13:45
General
- Target JaffaCakes118_e4c50c741c9271afbb640182582289ca.exe
- Size 107KB
- Sample250503-q2khbsttez
- SHA256 9e16949080d7ff8d8869ec558b9a4a0f33d1508e533325c22e4ceffccfa14d7a
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Control Panel 8 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4c50c741c9271afbb640182582289ca.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4c50c741c9271afbb640182582289ca.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.ttC331.tmp.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\lphc5clj0e3fk.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.ttC331.tmp.vbs
blphc5clj0e3fk.scr
memory/1420-0-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1420-1-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1420-2-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1420-3-0x0000000002280000-0x00000000022B0000-memory.dmp
memory/1420-4-0x0000000000401000-0x000000000040A000-memory.dmp
memory/1420-17-0x0000000003110000-0x00000000031C4000-memory.dmp
memory/1420-16-0x0000000003110000-0x00000000031C4000-memory.dmp
memory/1420-18-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1420-19-0x0000000002280000-0x00000000022B0000-memory.dmp