056f13467f7d27c25f47b1197b60843fa3b1279902f698b70ba9cecf6a018e8b

General

Target

85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe
Size

1.1MB
MD5

85240aff7adaca2e088c7c3232bffeb9
SHA1

d8f650da3281587c2d04ab48f2d69f3ce08eae46
SHA256

056f13467f7d27c25f47b1197b60843fa3b1279902f698b70ba9cecf6a018e8b
SHA512

9015abd5d24718d82d69f1e26b9bed0a95a75cea99a2b80464f4524d6052cfa355f51dce252508b83c1668d6ab5f600275adab69b5e1ada0d494034c45648299
SSDEEP

24576:DZVG5HRo0qBVLI96uCYOGfTJc3abtBSP7w69jF1+0sXUG3hz:vGJRABVz9YVVZBn6BF1M3hz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3512	starter.exe
4108	ArcadeYum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ArcadeYum.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ArcadeYum.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ArcadeYum.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ArcadeYum.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	ArcadeYum.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4108	ArcadeYum.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	ArcadeYum.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4108	ArcadeYum.exe
4108	ArcadeYum.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4108	3060	85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe	88
PID 3060 wrote to memory of 4108	3060	85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe	88
PID 3060 wrote to memory of 4108	3060	85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\85240aff7adaca2e088c7c3232bffeb9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe
  "C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe" IC9UaWNrZXQ9YTRBUEc1RElCVVNXREZXUWRsQlIgL0J1bmRsZXM9MTYzfDE0NXwxMzR8MTYyIC9PYmVyb249MCAvQnJvd3Nlcj0wIC9BZExvYz05MzYgL3RwZD1odHRwOi8vZDEuYXJjYWRleXVtLmNvbS9hai9idW5kbGUvOTM2Lz9wPU9UVTFNRGd6T0RjMk4zamNkenpXbTJHNUlITk9GaHo1TWd3TDRzS2N2TXNNTHBQMWkzdjAlMkJWc0I3V1ltc0pLTjdkYmE1d0tCQXg5MzVONnhXN0glMkJRVWR3Smxic3ByYk9nNzAlM0QgL29wdGltaXplR0M9MCAvdXNlck5hbWU9QWRtaW4gL3VzZXJTSUQ9Uy0xLTUtMjEtMTMzNzgyNDAzNC0yNzMxMzc2OTgxLTM3NTU0MzY1MjMtMTAwMAo=
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4108

C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe
"C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe" a4APG5DIBUSWDFWQdlBR 936
1⤵
- Executes dropped EXE
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe

Filesize
883KB

MD5
aa50875291714668d31c227e5b6b2a00

SHA1
674f0e185a12626b13c703cdabd9cab7b0d6e13d

SHA256
e2f9040b635f779bea1c60e6deca19e29f5ab2fcf0c291f188a257fb81189d76

SHA512
0fa6ac4e9b6c19fc4f37607410c3f4107aa68abb601ea1f33eb8eb092491092ae53dd56cddcb86d46d86dc9295b1edff7631c560f19aa46a2d6ec5daf901c187

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe.config

Filesize
231B

MD5
ae437dea18c61477cc2f17f46fb11d01

SHA1
94afba8148c6072ad60c6899ed717005681e9da5

SHA256
d8966d4c96ba3c910f86c44d6d7b6c298cc70cc3c5c61bb975861eed846b0754

SHA512
61ad33f07fbb65863f1eb02a14230c38766fbb5e1fe4263433ecd32375249e7af71e49f054e5f919884f5250dccf95fb6791ceeadf3c2d4cb468ba5af3e8902b

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\config.cfg

Filesize
74B

MD5
d69cf1edb213863c291d3a29748ad3fa

SHA1
405c35e4201a3056c2c595b52bf932e9064b657b

SHA256
2cfa9e65cfb72533449112eb8d97494011cd67f2214aca0180bacb899a210d87

SHA512
d22c28b2bdefeb0bf5382151bad68906294b3d4b953de34d37142daaf945a07128ea5dfe8c9772abfb8d044a2123c89a36b494090b5f9e0099458a498d4ed7f6

Download Submit
C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe

Filesize
1006KB

MD5
ccd7c3acc5b563797c6926535f18a579

SHA1
5f50db54840b1da117e7fa90f8d125ce52aa4328

SHA256
2761e3677c8af42974b10cb54c8b0c9b2a6a68101a3845fddbf0a039e5557816

SHA512
a700e95b5e97841183ae225aede90bc17be99d1cb76fa5e285a0305a8551bf35501f3e36aa24b7ff0d3fb42dd30b2043b3a457e0530c6fe90e51c2bd2ad1c6b8

Download Submit
memory/4108-12-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4108-11-0x00000000007A0000-0x0000000000882000-memory.dmp

Filesize
904KB

Download
memory/4108-10-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Filesize
4KB

Download
memory/4108-13-0x0000000005280000-0x0000000005312000-memory.dmp

Filesize
584KB

Download
memory/4108-14-0x0000000073DD0000-0x0000000074580000-memory.dmp

Filesize
7.7MB

Download
memory/4108-15-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/4108-16-0x0000000073DD0000-0x0000000074580000-memory.dmp

Filesize
7.7MB

Download
memory/4108-17-0x0000000073DD0000-0x0000000074580000-memory.dmp

Filesize
7.7MB

Download
memory/4108-20-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Filesize
4KB

Download
memory/4108-21-0x0000000073DD0000-0x0000000074580000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads