96a282babf5dde955edbca8cbcaf4337b0629bd6cf568774eebd6486663666a5

General

Target
5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
Size 846KB
Sample240520-dptt1sha33
SHA256 96a282babf5dde955edbca8cbcaf4337b0629bd6cf568774eebd6486663666a5
MD5 5ce3435b1b1be8e46d196809ee9f0226
SHA1 d87d21908204eadd8640d26769979bbcff2aa886
SHA512 e4b1376beb56f3e0f01c0a863397619a64e90723e6fa870e91ad551f8d6089c1d02ba291c7b58a131c497a2767abaaf45edc5c2190020b98b9ec2d8719906c92
SSDEEP 24576:GtWEmllf2nhgPqqCO84G3bHkTwtcTBCQ2u22:G+KxtEG3bHkM412u22
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4868	2236	5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe	82
PID 2236 wrote to memory of 4868	2236	5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe	82
PID 2236 wrote to memory of 4868	2236	5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe	82
PID 4868 wrote to memory of 1612	4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe	95
PID 4868 wrote to memory of 1612	4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe	95
PID 4868 wrote to memory of 1612	4868	internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\nst4383.tmp\internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\nst4383.tmp\internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe C:/Users/Admin/AppData/Local/Temp/nst4383.tmp /baseInstaller='C:/Users/Admin/AppData/Local/Temp/5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nst4383.tmp/fallbackfiles/'
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\13105.bat" "C:\Users\Admin\AppData\Local\Temp\B4378CDC54004DD494304164B0EDBCBB\""
    3⤵
    PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13105.bat

Path C:\Users\Admin\AppData\Local\Temp\13105.bat
Size 214B
SHA256 69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c
MD5 739fcc7ba42b209fe44bea47e7a8c48f
SHA1 bc7a448a7c018133edcf012bc94301623eb42c5b
SHA512 2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a
MD5 SHA1 SHA512

Submit Download

B4378CDC54004DD494304164B0EDBCBB_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\B4378CDC54004DD494304164B0EDBCBB\B4378CDC54004DD494304164B0EDBCBB_LogFile.txt
Size 10KB
SHA256 c544804e1ba71781529763e31a3e066de898e092cc80495e17b13693759af795
MD5 dfda5cdfa65766bef2c7aee3af0da8e4
SHA1 d5fa2c959febe22378899be14fd8ab82099f48c0
SHA512 9faa0dccb31535f2c7ad234bf1e20789c5a2ef5c96059be44a8f5e28adfc2de09f9eac12d81c9d36df89a8bc4e0429a4227c0746eef20f6259b5b9a45737ec5a
SSDEEP 192:NE9E8EHEXEOjEcEa8EjEMEu3zYEykEDEQEGE1EDEREHE7o:NE9E8EHEXEwEcEXEjEMEu0EykEDEQEGn
MD5 SHA1 SHA512 SSDEEP

Submit Download

B4378C~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\B4378CDC54004DD494304164B0EDBCBB\B4378C~1.TXT
Size 109KB
SHA256 1c5d018ef17a7aacec2ee2c4abf34e55fe78ed65a1daa98d19cb02d84658d0ba
MD5 46266ffd68cab59ea57d9659f09596f1
SHA1 2210b185d5b394748a6c5c16f477e73a37e5cd35
SHA512 9784785beb43cafd4c48f38bc07dfe2ca44a07e3d6c490f82b971da6f1be3e4cde1a83e5dcc4cff5d90385d042f595140e681ad14b77a4b641c8a124cfdbcf2c
SSDEEP 768:NE9E8EHEXEwEcEXEjEMEu0EykEDEQEGE1EDEREHE7VEQE2EhEubEuhEZEXEkE6EY:kkM8
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe

Path C:\Users\Admin\AppData\Local\Temp\nst4383.tmp\internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118.exe
Size 1.8MB
SHA256 9cffb8f38ca1ff1c7a6244e17dee39d8d379ba5816ced18aeadd91b46aa4a37c
MD5 b1d671736e8e4afd77b6a84f52a85165
SHA1 3392417c0f9ed0a3b0c3bac4b66f22ed459b29dd
SHA512 4ef78e54759f0a829daea4f79b75827dba6bf6a05666154112b535922a822152df40db2f2fca71fbfcf48ed8f3e730597a936bd8e40dc6192874c1608259b299
SSDEEP 49152:5SNY8H0ZGF5j51XdQTPRPgoFx1NslvUOl/WkMWAA:GY00Z8F1XdUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118_icon.ico

Path C:\Users\Admin\AppData\Local\Temp\nst4383.tmp\internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118_icon.ico
Size 17KB
SHA256 78d0ed2288334f341225acee3d6200d01bb0bb80b873c448ab151d0661817bf2
MD5 055c2cb77fa2edc2802b7fd397b9c213
SHA1 e6bf5af3427539bf609cfb8904b35803a06104d3
SHA512 7dc2930b9ac4843cca0a073a9195ab0cfb684b29c13622d0f934fb4b4a45af0fbb3a033f6ba31216214a9cbc1966436c36dd065c44b014c5c2a03dfd0b005a65
SSDEEP 96:XDvM6oG5UdUcuqdXnn/mycLMLnzI5aH+es/HlayQ4c6g5FHGCpthcepdozEgzWmn:XrZ5ISe/my9I0H+eCHbQ4c6geeDozn6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118_splash.png

Path C:\Users\Admin\AppData\Local\Temp\nst4383.tmp\internal5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118_splash.png
Size 12KB
SHA256 1cb036da61dc7b1ad62280681c724d74cbcc313d530a799728a4d38b4e2b1983
MD5 fe272d040e82704707b19bfbf29d65ca
SHA1 460de628ea63986a7e6390a1623d8ba32dc82aee
SHA512 8a03f9f3ce7af53b2f119f9bd001ff3fd39f879de88723306e2a6c7e8cae679d2095be6d4520ea24035c86140ef01a178a0b2535674be5c39b8b2dde4d082b1b
SSDEEP 384:uLGOts/16mbzoclsCGmutWLP5baar1nflf:uLjLQzochu8RbPrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2236-113-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2236-262-0x0000000000400000-0x000000000043B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads