16e5a758f95677cf94a64be3ac8c4f445a1d0b24238f62f157d08f395bf6d2ff

General

Target

68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe
Size

221KB
MD5

68f27c9ab94cc5e8b4e4791a77483b92
SHA1

7d87f8057b7395f0ebae5bb0a6195590a75d996f
SHA256

16e5a758f95677cf94a64be3ac8c4f445a1d0b24238f62f157d08f395bf6d2ff
SHA512

0cc2ed0826d9e78f514143b78d725d981b9597b65c0f809108e147e808f1a3748c06d3197db10ec0dccc5d53c6b3c09fff502a47d91fe892a29f008b0538fc8f
SSDEEP

6144:YvJbcJTI7keZP00gL0D4lexuNp4dhxQ5Drh9okobQ:YvKJc7k5JcLuNp4dDI/h9okobQ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

ins5510.exe

pid process

3788 ins5510.exe
Drops desktop.ini file(s) 2 IoCs

Processes:

ins5510.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini ins5510.exe
File opened for modification C:\Windows\assembly\Desktop.ini ins5510.exe

pid	process
3788	ins5510.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	ins5510.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ins5510.exe

Drops file in Windows directory 3 IoCs

Processes:

ins5510.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\Desktop.ini	ins5510.exe
File opened for modification	C:\Windows\assembly	ins5510.exe
File created	C:\Windows\assembly\Desktop.ini	ins5510.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dw20.exe

description pid process

Token: SeBackupPrivilege 4304 dw20.exe
Token: SeBackupPrivilege 4304 dw20.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ins5510.exe

pid process

3788 ins5510.exe
3788 ins5510.exe

description	pid	process
Token: SeBackupPrivilege	4304	dw20.exe
Token: SeBackupPrivilege	4304	dw20.exe

pid	process
3788	ins5510.exe
3788	ins5510.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exeins5510.exe

description	pid	process	target process
PID 2548 wrote to memory of 3788	2548	68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe	ins5510.exe
PID 2548 wrote to memory of 3788	2548	68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe	ins5510.exe
PID 3788 wrote to memory of 4304	3788	ins5510.exe	dw20.exe
PID 3788 wrote to memory of 4304	3788	ins5510.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68f27c9ab94cc5e8b4e4791a77483b92_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\n5510\ins5510.exe
"C:\Users\Admin\AppData\Local\Temp\n5510\ins5510.exe" ins.exe /t52e44d3dcdc63 /e12236294 /u17dced38-7f70-11e3-8a58-80c16e6f498c
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 1256
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4768

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n5510\ins5510.exe
Filesize
200KB

MD5
574a729a6d22be01601db50e4fc06908

SHA1
f9cb9978ee5aff0a7c2f2d6b7e8221f053c4d2a0

SHA256
a837cfc315a0076627b9e58c226831222416999720434498f10715b019ebbea2

SHA512
7152a713b0d52ad774c9dc8d47e80ce3847f58ace8f57c63f93394874863f673e4e73eed47b7debc5628098a8626ff6d0318f302281e6ddcca1f7f58ef3c497d

Download Submit
memory/2548-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2548-2-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2548-37-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3788-21-0x000000001C180000-0x000000001C21C000-memory.dmp

Filesize
624KB

Download
memory/3788-16-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-17-0x0000000000E60000-0x0000000000E6A000-memory.dmp

Filesize
40KB

Download
memory/3788-20-0x000000001BC10000-0x000000001C0DE000-memory.dmp

Filesize
4.8MB

Download
memory/3788-15-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-23-0x0000000000E80000-0x0000000000E88000-memory.dmp

Filesize
32KB

Download
memory/3788-24-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-25-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-26-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-32-0x00007FFFD7015000-0x00007FFFD7016000-memory.dmp

Filesize
4KB

Download
memory/3788-33-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-36-0x00007FFFD6D60000-0x00007FFFD7701000-memory.dmp

Filesize
9.6MB

Download
memory/3788-14-0x00007FFFD7015000-0x00007FFFD7016000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads