aad27f03a8b72e681b40032af20599750a885271e488d6ac2e9d6397a1866e76

General

Target

65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe
Size

845KB
MD5

65f873803715af67ab51efb7075e74d5
SHA1

790ea6a1aee8298e22269289fb79d14ed02eb70a
SHA256

aad27f03a8b72e681b40032af20599750a885271e488d6ac2e9d6397a1866e76
SHA512

15bba408b24721ae8ce25236579949b9ad4408f9bc7372a0316ae326980fb9e65cc991723ad2089a39ca04021defe9e4e6531e3151a4ff19868c770d5d7971c0
SSDEEP

12288:9tobaPum+c5G1QbnnoOouabkxacfurIL+7GuDiSHe8tHtxi79nIs6ZRI9ZO+7bX3:9tV/noOOkxansCaM+8jxitIHshb0e

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe
2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe
2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe
2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2172	1780	65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe	91
PID 1780 wrote to memory of 2172	1780	65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe	91
PID 1780 wrote to memory of 2172	1780	65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe	91
PID 2172 wrote to memory of 2160	2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe	100
PID 2172 wrote to memory of 2160	2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe	100
PID 2172 wrote to memory of 2160	2172	internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\nsnA9.tmp\internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\nsnA9.tmp\internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe C:/Users/Admin/AppData/Local/Temp/nsnA9.tmp /baseInstaller='C:/Users/Admin/AppData/Local/Temp/65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nsnA9.tmp/fallbackfiles/'
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3135.bat" "C:\Users\Admin\AppData\Local\Temp\B3ABDD0B7D1140F9BEDA300C0B8E0826\""
    3⤵
    PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3135.bat

Filesize
214B

MD5
739fcc7ba42b209fe44bea47e7a8c48f

SHA1
bc7a448a7c018133edcf012bc94301623eb42c5b

SHA256
69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c

SHA512
2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B3ABDD0B7D1140F9BEDA300C0B8E0826\B3ABDD0B7D1140F9BEDA300C0B8E0826_LogFile.txt

Filesize
6KB

MD5
bea16f4964f5c6bd07cee11906f60d5a

SHA1
a0a54ec39413119276e854479bf06c6cbf9f340b

SHA256
4be0f6ea2249f3c956511773ba9f389d5a61900a642022bdc17d88bcf316fc2f

SHA512
217ca82db467ee9832623f3dd6d30cd665a2200452bde2c946d5bf5b099b68963bd69b2585274294e3140949dd92f3d9d3a6e2aa779323b5b485b09667fdaa54

Download Submit
C:\Users\Admin\AppData\Local\Temp\B3ABDD0B7D1140F9BEDA300C0B8E0826\B3ABDD~1.TXT

Filesize
125KB

MD5
de881458e5e85ce0babd60ef4c41d175

SHA1
1ea0f819edd5ed71d0b29eeb675c00ae93ae3834

SHA256
50d6a5fa6d0e670284fed0c6245c33656c498c2d5ac431f55c13e96f845ed6d4

SHA512
2b03c1bbd58638a931d084ca010b12c0a5ff98f82a92ce14fab3b4156f9c186baa2e193adb1c2b957a5cb79db75b7062dddf82e98fe2bcad3c4acd6d868a0b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA9.tmp\internal65f873803715af67ab51efb7075e74d5_JaffaCakes118.exe

Filesize
1.8MB

MD5
799caa8125d22c36004c2a67fcacffa4

SHA1
eadd26fa7f4b437d3e9fdd24f937ca2e8a212654

SHA256
29745a486c04a8a2766814c5e0fb752a8dbc7b384a63e398d7262b315a8d49b5

SHA512
7c5d7dc18bf735bd4bf4452c850cc6fb4d3c98d9aa32a9873a4ca43349b6622b599452ee3b71ca07298e2d5aba58ece92815e74574ca1b56abaf7e99ebb4f8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA9.tmp\internal65f873803715af67ab51efb7075e74d5_JaffaCakes118_icon.ico

Filesize
31KB

MD5
e8325fb708961346591707c20ac048e4

SHA1
7950b4974f4445c335171fc17519605aa7389e25

SHA256
21d70c2d38bf043c666500e82a04551a3c901be00574eb6b3a91dfd9f709fb0e

SHA512
d7ec307074989a98f9f2e6ef94e8a94270477c286d715671058c58ab7ebef438ac9aaac8b01fcf1aed0e34101ecf29370e4c54a9b7e5a91743cb60bcc2bc5c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA9.tmp\internal65f873803715af67ab51efb7075e74d5_JaffaCakes118_splash.png

Filesize
19KB

MD5
d2659ae09f928fad3e819ccb6c7befef

SHA1
68e4e1dbdc3b9c3fe186c4ce11ddbacbf73de3d4

SHA256
4612e26da813cdad1b284bc1d03a5dc06b7f76b0e42b6dcaa14e620d9f4d2c6c

SHA512
40eba3ea02f7837041048a7d5f104799f037ae0371f36ec914f27a572fdce32826bde02ced60d7190e3bd8a9a29126121740b38350fc884567f3fc1e43be1ad5

Download Submit
memory/1780-87-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1780-288-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing