c7e590fffe5f2d661aba9c84b9c4bf40d945da9db48ff0aa3a7f2705b3c56e78

General

Target
c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe
Size 20KB
Sample240405-c39lysag25
SHA256 c7e590fffe5f2d661aba9c84b9c4bf40d945da9db48ff0aa3a7f2705b3c56e78
MD5 c87e31ef0b1b7912618476b8346afd88
SHA1 6be74c6687805cb8f4985897e8dce678e1541281
SHA512 7e9853ff1dc7ae6e4a50ed740a916b6001df7a43e59bab0548d41efac8e74208491c9ead55b4a1fd6c5157f2226e3d23a7657df72bced912330ce27e54cbfa9a
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41t:hDXWipuE+K3/SSHgxmHZ1t
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	DEM8B67.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	DEME157.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	DEM3776.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	DEM8D95.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	DEM34FA.exe

Executes dropped EXE 6 IoCs

pid	Process
4840	DEM34FA.exe
4120	DEM8B67.exe
3828	DEME157.exe
1344	DEM3776.exe
2248	DEM8D95.exe
4024	DEME3A4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4840	3048	c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe	97
PID 3048 wrote to memory of 4840	3048	c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe	97
PID 3048 wrote to memory of 4840	3048	c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe	97
PID 4840 wrote to memory of 4120	4840	DEM34FA.exe	100
PID 4840 wrote to memory of 4120	4840	DEM34FA.exe	100
PID 4840 wrote to memory of 4120	4840	DEM34FA.exe	100
PID 4120 wrote to memory of 3828	4120	DEM8B67.exe	102
PID 4120 wrote to memory of 3828	4120	DEM8B67.exe	102
PID 4120 wrote to memory of 3828	4120	DEM8B67.exe	102
PID 3828 wrote to memory of 1344	3828	DEME157.exe	104
PID 3828 wrote to memory of 1344	3828	DEME157.exe	104
PID 3828 wrote to memory of 1344	3828	DEME157.exe	104
PID 1344 wrote to memory of 2248	1344	DEM3776.exe	106
PID 1344 wrote to memory of 2248	1344	DEM3776.exe	106
PID 1344 wrote to memory of 2248	1344	DEM3776.exe	106
PID 2248 wrote to memory of 4024	2248	DEM8D95.exe	108
PID 2248 wrote to memory of 4024	2248	DEM8D95.exe	108
PID 2248 wrote to memory of 4024	2248	DEM8D95.exe	108

C:\Users\Admin\AppData\Local\Temp\c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c87e31ef0b1b7912618476b8346afd88_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\DEM34FA.exe
  "C:\Users\Admin\AppData\Local\Temp\DEM34FA.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Temp\DEM8B67.exe
    "C:\Users\Admin\AppData\Local\Temp\DEM8B67.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\DEME157.exe
      "C:\Users\Admin\AppData\Local\Temp\DEME157.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\DEM3776.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM3776.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\DEM8D95.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM8D95.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\DEME3A4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEME3A4.exe"
        7⤵
        Executes dropped EXE
        
        PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM34FA.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM34FA.exe
Size 20KB
SHA256 1709fa29cfdfbcaacbbefbbfc621f38443fd8bce6d7eb56304d43a17241ad883
MD5 1e1b8dce7882272009cc3fe42d51fa2d
SHA1 1a7c14185c216882a01e4f8e62144b1c792fcdf2
SHA512 e6e79f1b54239e8a99f1bc3168e404873d2102a3cc9e98a5e872baad9ba66685049a5d0bbc021f644e78b8ae28e3ea7157d2c29cafb86588eea1076d92b4d1e0
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41e:hDXWipuE+K3/SSHgxmHZ1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM3776.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM3776.exe
Size 20KB
SHA256 00bac16bd51506e37528486d2b584ec501f57beecd6cc40a4d3c8bc721ae109f
MD5 a38d66d05990d81b71552e310bd0dff8
SHA1 c4c747eb68dece949340216255a458238251f37a
SHA512 df7b4300ae0b5c9f93038bdb39ed4811b23c7ee15ac0f95356eb26afde9f138b3ef2ffbe9e1a45e2fc367d8e4676063f64320e4143a31ea952f83041fbd34986
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41N:hDXWipuE+K3/SSHgxmHZ1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM8B67.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM8B67.exe
Size 20KB
SHA256 2f062f8b074a49d96f9faee25e02e1086ec08f14a6580dcb2ad3ebe0294dd6bc
MD5 55cc5a7b18486ad03e7b358aa2b34a06
SHA1 30ead53a0c7e9d22528a9a88cabb8a0606ca9623
SHA512 33fbb080b058e1d6a06be739d917c7c8179ae0301a0ef343ffd98552030de1ccfb053b2f106d0e9a151b2d1114536b3d0c7b816c24da94079d42b91054750b17
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41+:hDXWipuE+K3/SSHgxmHZ1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM8D95.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM8D95.exe
Size 20KB
SHA256 aa2838bcedd84417064d49ca14b9f944673ddce1f1fa5c825f0cf94ccec50847
MD5 054df61cf5281497eb5c3b116d9276d0
SHA1 7aa0d77979bc19f8f0c29658378027e63dfee463
SHA512 b5ab2855a5ab6290b8829b2e3bdc69379d8184449fb0bd9596adb3308cc6f2d75f9782b3c0a86a0bc5d324db5f27ba86dd71414a06f96d4d77b99db1eeca9e41
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41j:hDXWipuE+K3/SSHgxmHZ1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEME157.exe

Path C:\Users\Admin\AppData\Local\Temp\DEME157.exe
Size 20KB
SHA256 95d31696c1b21f3cec5065973a3410fa0c2fec0a1ae30c38258066e50b41bdb1
MD5 584921f94ca45f8930dceff7e171e440
SHA1 81424b2046f988f4153f77023eca6470e230c27e
SHA512 617dcba7d31905ecb7a681f348ac15dddc70fa5e9171c57e9a109283b6df4eece7c31f38d90122c93069c7109279efbd0712b9abffdd9cde358b0f4c1b2cac30
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41D:hDXWipuE+K3/SSHgxmHZ1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEME3A4.exe

Path C:\Users\Admin\AppData\Local\Temp\DEME3A4.exe
Size 20KB
SHA256 ba2637117812a67e758524c53a056eac95ac118876ba0b18c55cfdbf1d37778d
MD5 fcbbde36c0f2f5579ddaaefd299a0e96
SHA1 9808ba39fed49389594805fb57a40ce9687cea99
SHA512 afeec6bc039a8d921f78ddad99323b52f4cd1ca62c4367afe859018b3c39fa77214986845939b7626661a49addd258adc36ba21a337a80a34cc27eefd112561c
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41J:hDXWipuE+K3/SSHgxmHZ1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads