4fd62a2e42e0ad9827f0b5703607c0de1ab31e3dabd60aaf3cb56dbba746df04

General

Target

fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe
Size

8.9MB
MD5

fb48807b8d01f1ba353018b2d4a38c8d
SHA1

ed2f17a502b147384d080b9d5faed3bc27eb289b
SHA256

4fd62a2e42e0ad9827f0b5703607c0de1ab31e3dabd60aaf3cb56dbba746df04
SHA512

838c0f0cb61ee3d3a93f5c5cab5546b62802243d2c39c61205c85325bdac40ca1f0752c54f89c7362d8920e2e1faad21596688b1b45bc78a808ed53e85fa8654
SSDEEP

196608:8yazg7DSmyazg7DSmRyazg7DSmyazg7DSmQ:wg7uqg7u8g7uqg7uj

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
5092	7D57AD13E21.exe
2404	Scegli_nome_allegato.exe
2204	7D57AD13E21.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 2204	5092	7D57AD13E21.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\IESettingSync	Scegli_nome_allegato.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Scegli_nome_allegato.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Scegli_nome_allegato.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Scegli_nome_allegato.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3840	reg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2404	Scegli_nome_allegato.exe
2404	Scegli_nome_allegato.exe
2404	Scegli_nome_allegato.exe
2204	7D57AD13E21.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3840	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	98
PID 1480 wrote to memory of 3840	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	98
PID 1480 wrote to memory of 3840	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	98
PID 1480 wrote to memory of 5092	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	100
PID 1480 wrote to memory of 5092	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	100
PID 1480 wrote to memory of 5092	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	100
PID 1480 wrote to memory of 2404	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	101
PID 1480 wrote to memory of 2404	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	101
PID 1480 wrote to memory of 2404	1480	fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe	101
PID 5092 wrote to memory of 2204	5092	7D57AD13E21.exe	106
PID 5092 wrote to memory of 2204	5092	7D57AD13E21.exe	106
PID 5092 wrote to memory of 2204	5092	7D57AD13E21.exe	106
PID 5092 wrote to memory of 2204	5092	7D57AD13E21.exe	106
PID 5092 wrote to memory of 2204	5092	7D57AD13E21.exe	106

C:\Users\Admin\AppData\Local\Temp\fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb48807b8d01f1ba353018b2d4a38c8d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3840
- C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
  "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe
    "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2204
- C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe
  "C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe

Filesize
8.9MB

MD5
fa1f4da6a63faba794448cadbd22d2a8

SHA1
6afa7dd50a2c7eb029f40e7adc283f8f531815b4

SHA256
b0766c6e4cca5ce38fb5d55abc9e8916ddc5684340f6f115f7996d47e4a07649

SHA512
8957897153cafaa461cf8a1f5487c33aadb03bfd0d924e9219a7dd0a0d8cf82e5ef0338c53e3a629b5f05e304faec2f4c29ef94d64290f998cdebdb2661fd964

Download Submit
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe

Filesize
1.0MB

MD5
a2f259ceb892d3b0d1d121997c8927e3

SHA1
6e0a7239822b8d365d690a314f231286355f6cc6

SHA256
ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420

SHA512
5ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad

Download Submit
memory/1480-24-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/1480-1-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/1480-11-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/1480-0-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2204-37-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2204-35-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2204-44-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2204-41-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2204-39-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2204-31-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2204-33-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2404-38-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2404-26-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2404-30-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/2404-28-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/5092-34-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download
memory/5092-12-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/5092-29-0x0000000000400000-0x0000000000601000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads