15a753293410c974b66140a91e2645705a4de23fc2fe4d2758f343347bfa43ac

General

Target
1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe
Size 16KB
Sample240329-kapp3sda9z
SHA256 15a753293410c974b66140a91e2645705a4de23fc2fe4d2758f343347bfa43ac
MD5 1d468e5381f4338fad5bb2316bbab01f
SHA1 4d4142595ad1f1ba173b679400b40c087f86edbe
SHA512 45ae66f656c25d25093c8b44324029c6313caff9bd97ac8d034f49f8ad78540a3f98c0e08332320bc9818cd4e8d277594ee69375a0c3d92d25a5afde91f79c06
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRX:hDXWipuE+K3/SSHgxr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEM5AD8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEMEEF4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEM50DA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEMA8BE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEM13E.exe

Executes dropped EXE 6 IoCs

pid	Process
4212	DEMEEF4.exe
2608	DEM50DA.exe
4152	DEMA8BE.exe
5108	DEM13E.exe
3816	DEM5AD8.exe
4692	DEMB387.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4212	3588	1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe	103
PID 3588 wrote to memory of 4212	3588	1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe	103
PID 3588 wrote to memory of 4212	3588	1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe	103
PID 4212 wrote to memory of 2608	4212	DEMEEF4.exe	107
PID 4212 wrote to memory of 2608	4212	DEMEEF4.exe	107
PID 4212 wrote to memory of 2608	4212	DEMEEF4.exe	107
PID 2608 wrote to memory of 4152	2608	DEM50DA.exe	109
PID 2608 wrote to memory of 4152	2608	DEM50DA.exe	109
PID 2608 wrote to memory of 4152	2608	DEM50DA.exe	109
PID 4152 wrote to memory of 5108	4152	DEMA8BE.exe	111
PID 4152 wrote to memory of 5108	4152	DEMA8BE.exe	111
PID 4152 wrote to memory of 5108	4152	DEMA8BE.exe	111
PID 5108 wrote to memory of 3816	5108	DEM13E.exe	113
PID 5108 wrote to memory of 3816	5108	DEM13E.exe	113
PID 5108 wrote to memory of 3816	5108	DEM13E.exe	113
PID 3816 wrote to memory of 4692	3816	DEM5AD8.exe	115
PID 3816 wrote to memory of 4692	3816	DEM5AD8.exe	115
PID 3816 wrote to memory of 4692	3816	DEM5AD8.exe	115

C:\Users\Admin\AppData\Local\Temp\1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1d468e5381f4338fad5bb2316bbab01f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\DEMEEF4.exe
  "C:\Users\Admin\AppData\Local\Temp\DEMEEF4.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Users\Admin\AppData\Local\Temp\DEM50DA.exe
    "C:\Users\Admin\AppData\Local\Temp\DEM50DA.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\DEMA8BE.exe
      "C:\Users\Admin\AppData\Local\Temp\DEMA8BE.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\DEM13E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM13E.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\DEM5AD8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM5AD8.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\DEMB387.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMB387.exe"
        7⤵
        Executes dropped EXE
        
        PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM13E.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM13E.exe
Size 16KB
SHA256 da507efc923aac51563579cf27188cd1c786da2d2f8dfb9ddbe78492ca139fa5
MD5 2819a7baf24fdfb104e686debe5789f0
SHA1 bec54be73e9ed6d198652a3a962d4f83533b2b97
SHA512 bdbfd5faeef957269432b241734b334b6407ee6d563255faed0b7cc93c47e8483cc99ce5a97c4e19676316f721cebf8c8cfea980217d31d7018cf336a1a18b65
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhR+:hDXWipuE+K3/SSHgxa
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM50DA.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM50DA.exe
Size 16KB
SHA256 d5c7f7b1d4d45d1e51bff86eb2926cec40df5a542441dd81b3836623ea99c327
MD5 dac5a4307b5c12187868980f85d458f4
SHA1 186e597fbafa7967283ff05933aa49d72e252f2d
SHA512 e12f6cb7282ab2dec2b684c2104df79ca90d697df8eaec97a9bf74d7a961fedbe4243dc4c609f912de199873b9759664933c314ce982dab523a888dccc3a3218
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhR0:hDXWipuE+K3/SSHgxA
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM5AD8.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM5AD8.exe
Size 16KB
SHA256 a1acfecf3d6fec27835a8a24550467bf91ead222e75416b29aa7568652426ecf
MD5 c408d03da875f0727e7a47a49ef05029
SHA1 0fe9a031ae27e6cd7aa444a1d88f39831dc45ace
SHA512 3076cc1db528fba40946dd28aec995f5bf80fd821d7447157415fdaa94d7841cbeffbfa116f802f09e160be0c53903e529ce5580e782b01cb73f3ed4f3a4bba7
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRB:hDXWipuE+K3/SSHgxd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMA8BE.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMA8BE.exe
Size 16KB
SHA256 d0e300356256c37f4730e04fa0befe72f97e74b50709fcc8f2b18486961173c0
MD5 2b22288eaaf456d89d693835c2ffacc9
SHA1 2955616283a0619ebde915e396c0222f4519b46a
SHA512 d731cc76f1ec53f9003cf41e67bbf4addca66c1d19d1f1f3fd929e3f2962b737ccfc714f9145fdd956a3b01b536f2621e2f239dcb0914ada75f242ac322f160d
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRa:hDXWipuE+K3/SSHgxm
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMB387.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMB387.exe
Size 16KB
SHA256 1fb0fc05e4ff5a6be02c3cd104fb0a021d4e2209e5094d277506863cd97a3d67
MD5 5314c44609718ea298a92724b0e482a5
SHA1 950b1dec56c04c5a8d082c751b4f83cdceb0bfed
SHA512 bde8341fcd6ba6b8f21cbffa526cc5e82352f76ac0e367cda1c54cc41206bc9dd4dcf3a58e779c1b1a11dc721c3bd4724822beeaac3117cab987b432e1c76ca3
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRj:hDXWipuE+K3/SSHgxH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMEEF4.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMEEF4.exe
Size 16KB
SHA256 e23920f92ae29a87c7d9cd1341204282301dfb02bef74a11468f6bad8568be4f
MD5 901afd26326edabb244018d3cc62eb92
SHA1 0a3a0a13f57acf32647ba936955e4ce52e17ae29
SHA512 356089aef1b19a42684f0d6be36ef1d2cd37841b087faf183234919c813b52dd4fe5abb103b638fc2081696c0ffa84b70488c61e7b4728d623c10cd3b7b23de7
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRe:hDXWipuE+K3/SSHgxq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads