803361d5958383b2d27c63a941487c22e2b3196e4f936ef86e34e2fa8481f9d3

General

Target
25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe
Size 16KB
Sample240329-szhxtscb24
SHA256 803361d5958383b2d27c63a941487c22e2b3196e4f936ef86e34e2fa8481f9d3
MD5 25be2bd7707446bc5d1e864faac8a716
SHA1 974504700b94ff850f2cae99d55f8cce5cc1e245
SHA512 5f20caf80873bb3cf6b4a713c39a1397629914f661283c6a7181ad94be46107a54535721411d5f0a4d7fcd4fc6434d60d8a4141b650aef2c15118dda63b2b7bd
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhZluz:hDXWipuE+K3/SSHgx3luz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	DEM3F4B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	DEM95F6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	DEMEC15.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	DEM4205.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	DEM9843.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe

Executes dropped EXE 5 IoCs

pid	Process
864	DEM3F4B.exe
1992	DEM95F6.exe
3952	DEMEC15.exe
3984	DEM4205.exe
3544	DEM9843.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 864	4556	25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe	93
PID 4556 wrote to memory of 864	4556	25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe	93
PID 4556 wrote to memory of 864	4556	25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe	93
PID 864 wrote to memory of 1992	864	DEM3F4B.exe	96
PID 864 wrote to memory of 1992	864	DEM3F4B.exe	96
PID 864 wrote to memory of 1992	864	DEM3F4B.exe	96
PID 1992 wrote to memory of 3952	1992	DEM95F6.exe	98
PID 1992 wrote to memory of 3952	1992	DEM95F6.exe	98
PID 1992 wrote to memory of 3952	1992	DEM95F6.exe	98
PID 3952 wrote to memory of 3984	3952	DEMEC15.exe	100
PID 3952 wrote to memory of 3984	3952	DEMEC15.exe	100
PID 3952 wrote to memory of 3984	3952	DEMEC15.exe	100
PID 3984 wrote to memory of 3544	3984	DEM4205.exe	102
PID 3984 wrote to memory of 3544	3984	DEM4205.exe	102
PID 3984 wrote to memory of 3544	3984	DEM4205.exe	102

C:\Users\Admin\AppData\Local\Temp\25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25be2bd7707446bc5d1e864faac8a716_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\DEM3F4B.exe
  "C:\Users\Admin\AppData\Local\Temp\DEM3F4B.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\DEM95F6.exe
    "C:\Users\Admin\AppData\Local\Temp\DEM95F6.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\DEMEC15.exe
      "C:\Users\Admin\AppData\Local\Temp\DEMEC15.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\DEM4205.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM4205.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\DEM9843.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM9843.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\DEMEE53.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMEE53.exe"
        7⤵
        
        PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM3F4B.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM3F4B.exe
Size 16KB
SHA256 3b1713c5f7ac37669c8d4b42f5e2755d244ebc113657da7523e5b710ca1987e3
MD5 eaa437b4546750ee1c431c723e574609
SHA1 57a016166ba1fe6cfe270eb10fed8e3db7db7b60
SHA512 ead39e9e4f9543286d5ee68bb89ac1ef4f9ea7ac2605dee74a4ef783afef1357e9ef40f88387b0f13eeed8c74250b502e8e5b708751961873c4f282919710ed5
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhZlur:hDXWipuE+K3/SSHgx3lur
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM4205.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM4205.exe
Size 16KB
SHA256 5fd89039000d9bb334d53b8c76acaffc4d06d7ac611692e0ed367a1514fcd212
MD5 94e590c2edb25edc5598a9b0f3fa4e41
SHA1 fbae6aa733969d6fe0397ba13e5ae34c25130440
SHA512 bd1c53b779eb7128fc1b5bafdee74f7cb39aa1555fc3287b58d4cf0c791e9a487b51398ab5aaa4a3798f48cc4a2b10483862e43126ec8572033fa71fda372c1e
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhZlu3:hDXWipuE+K3/SSHgx3lu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM95F6.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM95F6.exe
Size 16KB
SHA256 30e0d13477b8754136a7543a74e24c54d55b45678dd4a7e29b5c736983f1658a
MD5 3b293cb3f168ea9d625618f0cca15a13
SHA1 67c7d8804a89ca3299d782dd25229915aa950c36
SHA512 0c28e8f66fb29efa05add5ca2a1506001f2661d1066f54f304ffcad06a5908f2122395074e04939d5b577f49b2cb2f47a54f15eb687b2e95b138c38c3fa770c0
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhZlun:hDXWipuE+K3/SSHgx3lun
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM9843.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM9843.exe
Size 16KB
SHA256 eb7ff509d0cfe7dfd94c71eef2b78e4d9476d45517c5e6fdfcd4129c6d79db49
MD5 009e8188698f656987ffc5cd8d2c839b
SHA1 bd54895ef993b00dcd9337251063e0931847e067
SHA512 aa498a6f84583c311fffc78ab156d362976b6cb1bed59c9d0776edaf36ff5dfa684bc0654e82e9032c84f4af80fcf4f630e8875394eddced1282082372bd78a9
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhZlus:hDXWipuE+K3/SSHgx3lus
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMEC15.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMEC15.exe
Size 16KB
SHA256 dc2acfe278debb2f107991a0462a50738aec1a1a98bfdc630b33132d6507b88c
MD5 c39e961557d18ab58c68b180c58c3601
SHA1 fb22ab40c097be3a9bb2c847f5bc49d2b1dae07e
SHA512 d9b8bd43dd8a0e2ac304cbe3a98bb9489d195853f080e0834c2e4b2057d1a837be81517dfdd3cf613a1008a1f5a170a92ac95087295067be2e595195afacfa09
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhZluX:hDXWipuE+K3/SSHgx3luX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads