79c99a7c09e33d264e7e79c66e3d71bdad8a760e660c35d3f05c135b537c4646

General

Target
d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe
Size 15KB
Sample240405-t1cb4shd38
SHA256 79c99a7c09e33d264e7e79c66e3d71bdad8a760e660c35d3f05c135b537c4646
MD5 d8e67015c8bcb197a25018ad87c327f9
SHA1 1a2cc0b155f1d2634eda9ba88f996bc5e63a1321
SHA512 40bdaf1ed3a2cba8d941672679fcd28dc43d02d0e60e06b273ca713975d870233d8a8edc3d4b33d3e8ae4b4684b7988689842dd0c40528ab0f738205a6a6b4aa
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/vj:hDXWipuE+K3/SSHgx//vj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEM18BE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEM71DB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEMA4C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEM67DD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	DEMC07C.exe

Executes dropped EXE 6 IoCs

pid	Process
4580	DEMA4C.exe
3504	DEM67DD.exe
5024	DEMC07C.exe
4924	DEM18BE.exe
2756	DEM71DB.exe
1084	DEMCAD8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4580	3004	d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe	103
PID 3004 wrote to memory of 4580	3004	d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe	103
PID 3004 wrote to memory of 4580	3004	d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe	103
PID 4580 wrote to memory of 3504	4580	DEMA4C.exe	107
PID 4580 wrote to memory of 3504	4580	DEMA4C.exe	107
PID 4580 wrote to memory of 3504	4580	DEMA4C.exe	107
PID 3504 wrote to memory of 5024	3504	DEM67DD.exe	109
PID 3504 wrote to memory of 5024	3504	DEM67DD.exe	109
PID 3504 wrote to memory of 5024	3504	DEM67DD.exe	109
PID 5024 wrote to memory of 4924	5024	DEMC07C.exe	111
PID 5024 wrote to memory of 4924	5024	DEMC07C.exe	111
PID 5024 wrote to memory of 4924	5024	DEMC07C.exe	111
PID 4924 wrote to memory of 2756	4924	DEM18BE.exe	113
PID 4924 wrote to memory of 2756	4924	DEM18BE.exe	113
PID 4924 wrote to memory of 2756	4924	DEM18BE.exe	113
PID 2756 wrote to memory of 1084	2756	DEM71DB.exe	115
PID 2756 wrote to memory of 1084	2756	DEM71DB.exe	115
PID 2756 wrote to memory of 1084	2756	DEM71DB.exe	115

C:\Users\Admin\AppData\Local\Temp\d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d8e67015c8bcb197a25018ad87c327f9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\DEMA4C.exe
  "C:\Users\Admin\AppData\Local\Temp\DEMA4C.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\DEM67DD.exe
    "C:\Users\Admin\AppData\Local\Temp\DEM67DD.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\DEMC07C.exe
      "C:\Users\Admin\AppData\Local\Temp\DEMC07C.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\DEM18BE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM18BE.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\DEM71DB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM71DB.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\DEMCAD8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMCAD8.exe"
        7⤵
        Executes dropped EXE
        
        PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM18BE.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM18BE.exe
Size 15KB
SHA256 ce730de0f0867805864a93097de015d645799c0974b6ceb111bfcd26a65851b8
MD5 95d3bc572e46e806dd23b87a86526e7f
SHA1 c2c822d8e757164574606b82f6b62e2b18c3a90d
SHA512 d53f2354c1e78302c1d7d5f1a6a65d10c653730ebefce2853c01ed0b43d4c9cf0ef22501986a4b9d9f9e024a328243ac6a2b918d0d7925b5f18f7302d27aa6b9
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/vK:hDXWipuE+K3/SSHgx//vK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM67DD.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM67DD.exe
Size 15KB
SHA256 8e3991f78659a6144817cc027ce280bb3d7467647b4b47d59ec2077d8c3c7301
MD5 6f6ff65a229404a523f3bb1c756e873a
SHA1 833abde9520f0cb4b867a65842dd175da94e1812
SHA512 7c9f10549349e717de79b37d1ad0708e52ed447c42b8564c11d8fb0cd0edc95c2735347441477b05924e420f3d4d8c0c5f5f0373e9237e1ec1dad8b3bab2b4e5
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/vi:hDXWipuE+K3/SSHgx//vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM71DB.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM71DB.exe
Size 15KB
SHA256 bf31b713efb92580733133272ba12ef2d191ea10ba1d6952667dfcf1074df137
MD5 8f81e79af855f355e10785845d25b24b
SHA1 41c78e111b0117b0c98eccb25c5d0de214c78d15
SHA512 40d52ce7d65b3e18c6ebb0d0346361e31c2371f897163e5c8367a4b31936c500536eda533a0c16483a8429bafe272381e9b6389f352135c360efb9410d4dce9c
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/vT:hDXWipuE+K3/SSHgx//vT
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMA4C.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMA4C.exe
Size 15KB
SHA256 8b8930b93643bd66be7e4f0a82b61eb2b23837e9b44e532743e70363440e5007
MD5 16c96a53881ab5dd2b42d94e180fd44e
SHA1 d7f62458be1e5537640faa03809f7ffa50d25123
SHA512 1f1917b38451f7d5c9352500f8fef3bc703379c2493aeb357a56d7448fed0cbd5ed835e2b133b8b0b53f5971343ef9427d727204d1c1b6ef6903185d217e2afa
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/v9:hDXWipuE+K3/SSHgx//v9
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMC07C.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMC07C.exe
Size 15KB
SHA256 e8824839acefe5671c2b175e8135ae5e9232c4bb9dfe917597f4d0a3462d16c9
MD5 767449c6815d186b5758285c685b5391
SHA1 cd2c33eb3adbd4d438563977bddf499203761af5
SHA512 8e30d816403ad5a02b80eeb90c55164e1b1f24c17033f56c72e855151650dd8ef162a17c10a4393efefe2ddf640241b90304ccc636737d9147ff8e7edd1e6340
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/vw:hDXWipuE+K3/SSHgx//vw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMCAD8.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMCAD8.exe
Size 15KB
SHA256 b5df19207f3250d2425ae31641a25c9df2aab610bb313b3fee1b711262b007f4
MD5 228d3592b3d02ea3c87eaf56cb52cf5f
SHA1 1be56bcae987e4d67be5e0544b2c51d12fbcc473
SHA512 78132993fed14872c2595309849910ac1aedfc3110eb3e77ca10a37b698672e2780dcb26ebcc27967ff0aab0ab3a73a4c73b47d3404ec8030e6c8dbc8ddeaae5
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4Yh4cn/vk:hDXWipuE+K3/SSHgx//vk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads