e2ae055cdc05ba3abb0fc6fe13496163de4c88e98ede89a73081346d978a04a2

General

Target

c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe
Size

3.3MB
MD5

c1cc58843c8cdb4665b2f2cbad644c01
SHA1

0829deafb730edf6870cb95ce0ec08fac6617b6c
SHA256

e2ae055cdc05ba3abb0fc6fe13496163de4c88e98ede89a73081346d978a04a2
SHA512

e8ec2479dc9b55e268d159e98afcfd3168d4da08b7c961c21f067cfb0549551098e0bae0910cb7b2baff545d52c0f107a82e6329c7a8a4646c1fdc71b2e43710
SSDEEP

98304:1oDhtnt/FPR9hOxTq2bzWvP9fyZwVsRsbn9Fk0hg8:ODvJFPR9hOY2bzYlaY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Executes dropped EXE 1 IoCs

pid	Process
4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Loads dropped DLL 1 IoCs

pid	Process
4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
2596	taskkill.exe
2640	taskkill.exe
4920	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	taskkill.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4544	2820	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	93
PID 2820 wrote to memory of 4544	2820	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	93
PID 2820 wrote to memory of 4544	2820	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	93
PID 4544 wrote to memory of 2640	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	96
PID 4544 wrote to memory of 2640	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	96
PID 4544 wrote to memory of 2640	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	96
PID 4544 wrote to memory of 4920	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	99
PID 4544 wrote to memory of 4920	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	99
PID 4544 wrote to memory of 4920	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	99
PID 4544 wrote to memory of 2596	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	101
PID 4544 wrote to memory of 2596	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	101
PID 4544 wrote to memory of 2596	4544	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	101

C:\Users\Admin\AppData\Local\Temp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\is-DS46U.tmp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DS46U.tmp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp" /SL5="$D01C4,2928163,216576,C:\Users\Admin\AppData\Local\Temp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "DuplicatePhotosFixerPro.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "DuplicatePhotosFixerPro.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "DuplicatePhotosFixerPro.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3840 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-DS46U.tmp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Filesize
1.2MB

MD5
f1c5da2331fb8c0e25ffda0708d7b2df

SHA1
f54d113a434c1a7ba7ab696fa8189e723fb4d30f

SHA256
6a653fe8a916b9e76fee1905e01bcd5c01c7d3ae8f32ef1f5e4144c705709073

SHA512
f2e2e5e3f18f128d879d343ea8d07f3ef7ed26e606e0e1eaf35136219483ab81d94a3e2e934b208831a576bb8807e59862c6db02d89083c749395263edb5872e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P87VO.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
memory/2820-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2820-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4544-6-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/4544-17-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/4544-20-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing