e39526b4604d89b701f9d58d8af91576d6965fe3019bd0dd04e35355d102a260

General

Target

f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe
Size

2.9MB
MD5

f7ff003ad7867968b49dc22fa1937a54
SHA1

0163cea6242de599faac018b20bd615fb6a77a87
SHA256

e39526b4604d89b701f9d58d8af91576d6965fe3019bd0dd04e35355d102a260
SHA512

6ae85375683e8674f098fad209924c3855e313829275b284860f83f28c5dadfa40df9b65fef1eac3ef5cf9987cd057ca8a1b41ef201be0b0803942e918b9cac5
SSDEEP

49152:xF3IbU7MPuhy8uq9sZSpqwe3JkYIljlw5ynLdoLKha9Buuk1ygctMfm9Q:vYbVvgISvwrklwMdIKFqnBQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
736	Sint.exe

Loads dropped DLL 1 IoCs

pid	Process
4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Numquam\occaecati\Sint.exe	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Numquam\occaecati\sqlite3.dll	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\unins000.dat	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-SB984.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-O86MB.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-BK03M.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\ea\is-ROOR2.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-2824O.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-B2IKI.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Numquam\unins000.dat	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-9OOF0.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-5SN1Q.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\ea\is-9ETUI.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-720Q0.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-D6BFH.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\ea\is-ALKU9.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-BKULC.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-CUF2T.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-PUQ4N.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\is-USR8K.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-RM92A.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-NEHQN.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-URRPV.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Numquam\occaecati\is-AFCGI.tmp	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3904	736	WerFault.exe	89
380	736	WerFault.exe	89
1964	736	WerFault.exe	89
3344	736	WerFault.exe	89
2348	736	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
736	Sint.exe
736	Sint.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4712	4320	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe	84
PID 4320 wrote to memory of 4712	4320	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe	84
PID 4320 wrote to memory of 4712	4320	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe	84
PID 4712 wrote to memory of 736	4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp	89
PID 4712 wrote to memory of 736	4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp	89
PID 4712 wrote to memory of 736	4712	f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp	89

C:\Users\Admin\AppData\Local\Temp\f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\is-HRAR0.tmp\f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HRAR0.tmp\f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp" /SL5="$160040,2638614,118784,C:\Users\Admin\AppData\Local\Temp\f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files (x86)\Numquam\occaecati\Sint.exe
    "C:\Program Files (x86)\Numquam/\occaecati\Sint.exe" 53d1f54551d40956db57e0eb679e7cc0
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1000
      4⤵
      Program crash
      PID:3904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 524
      4⤵
      Program crash
      PID:380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1124
      4⤵
      Program crash
      PID:1964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1116
      4⤵
      Program crash
      PID:3344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1144
      4⤵
      Program crash
      PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 736 -ip 736
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 736 -ip 736
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 736 -ip 736
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 736 -ip 736
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 736 -ip 736
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Numquam\occaecati\Sint.exe

Filesize
2.9MB

MD5
57d246b651f599e4eee146d54c11d9b6

SHA1
63c855a6ce36c8c36154138e57df4fee0521c9d3

SHA256
fdd53944953172d831ad07753fe282785e3111b2628a206df2975cfe6655fa8d

SHA512
4eb7b70c7a90ad631f02e90f0fbc502c2cf93c1ee6e4af2c003d868b5a8908c346fc09ea83a8e6de4d5a02903bfef199c8bb8587aecdde94dc827212f8db4dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GD3S6.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HRAR0.tmp\f7ff003ad7867968b49dc22fa1937a54_JaffaCakes118.tmp

Filesize
1.1MB

MD5
b69b348d3ef2973bf1dde47370b7a393

SHA1
fea161fd274600613c5e409aa2df15fa62110532

SHA256
5caf88d958ea88ffad7493b344f5addcb3b378d735ba81bafe29903f0fa6eec4

SHA512
0a347c800e0973ed9a9693c4e58f53828c2301817b9ec1446781fa02839ad680e4122b20384ca80629c24827ccfe2028b80fb12bfeca07e1af7563e2fb89785f

Download Submit
memory/736-61-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/736-68-0x0000000000400000-0x00000000014F2000-memory.dmp

Filesize
16.9MB

Download
memory/736-64-0x0000000000400000-0x00000000014F2000-memory.dmp

Filesize
16.9MB

Download
memory/736-59-0x0000000000400000-0x00000000014F2000-memory.dmp

Filesize
16.9MB

Download
memory/736-60-0x0000000000400000-0x00000000014F2000-memory.dmp

Filesize
16.9MB

Download
memory/4320-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4320-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4320-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4712-63-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4712-7-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4712-67-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing