d15805c32b413040e8a0fb740465acf7d85efbe741e1689a9a82c5e1e601def0

General

Target

898446324be148af2b7f41028ed4477a_JaffaCakes118.exe
Size

562KB
MD5

898446324be148af2b7f41028ed4477a
SHA1

ff78713a43af6b335d3f3470b5d38ffdd96d38bc
SHA256

d15805c32b413040e8a0fb740465acf7d85efbe741e1689a9a82c5e1e601def0
SHA512

cde3bc6dd175daa853d1c18e365df6c28b737cff5d671a6c5eba6dce12b893cb8ad8e29c1f5eea496e2f338f270bd3d6305bef2802c41ec2d78017dbc9c59aaa
SSDEEP

12288:ot0V2auKKQ1ZQ3uiBb2IFis1CwI5DEpU7R:SwYPQMeicZ

Score

7^/10

agilenet

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

898446324be148af2b7f41028ed4477a_JaffaCakes118.exewalmart.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	walmart.exe

Drops startup file 1 IoCs

Processes:

walmart.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\walmart.lnk walmart.exe
Executes dropped EXE 2 IoCs

Processes:

walmart.exewalmart.exe

pid process

1480 walmart.exe
380 walmart.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\walmart.lnk	walmart.exe

pid	process
1480	walmart.exe
380	walmart.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3220-2-0x0000000004BA0000-0x0000000004BC0000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

898446324be148af2b7f41028ed4477a_JaffaCakes118.exewalmart.exewalmart.exe

description	pid	process
Token: SeDebugPrivilege	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe
Token: SeDebugPrivilege	1480	walmart.exe
Token: SeDebugPrivilege	380	walmart.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

898446324be148af2b7f41028ed4477a_JaffaCakes118.exeexplorer.exewalmart.exe

description	pid	process	target process
PID 3220 wrote to memory of 3196	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe	cmd.exe
PID 3220 wrote to memory of 3196	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe	cmd.exe
PID 3220 wrote to memory of 3196	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe	cmd.exe
PID 3220 wrote to memory of 680	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe	explorer.exe
PID 3220 wrote to memory of 680	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe	explorer.exe
PID 3220 wrote to memory of 680	3220	898446324be148af2b7f41028ed4477a_JaffaCakes118.exe	explorer.exe
PID 2872 wrote to memory of 1480	2872	explorer.exe	walmart.exe
PID 2872 wrote to memory of 1480	2872	explorer.exe	walmart.exe
PID 2872 wrote to memory of 1480	2872	explorer.exe	walmart.exe
PID 1480 wrote to memory of 380	1480	walmart.exe	walmart.exe
PID 1480 wrote to memory of 380	1480	walmart.exe	walmart.exe
PID 1480 wrote to memory of 380	1480	walmart.exe	walmart.exe
PID 1480 wrote to memory of 1676	1480	walmart.exe	walmart.exe
PID 1480 wrote to memory of 1676	1480	walmart.exe	walmart.exe
PID 1480 wrote to memory of 1676	1480	walmart.exe	walmart.exe

C:\Users\Admin\AppData\Local\Temp\898446324be148af2b7f41028ed4477a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\898446324be148af2b7f41028ed4477a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\898446324be148af2b7f41028ed4477a_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\walmart.exe"
2⤵
PID:3196

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\walmart.exe"
2⤵
PID:680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\walmart.exe
"C:\Users\Admin\AppData\Local\walmart.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\walmart.exe
"C:\Users\Admin\AppData\Local\walmart.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Users\Admin\AppData\Local\walmart.exe
"C:\Users\Admin\AppData\Local\walmart.exe"
3⤵
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\walmart.exe
Filesize
562KB

MD5
898446324be148af2b7f41028ed4477a

SHA1
ff78713a43af6b335d3f3470b5d38ffdd96d38bc

SHA256
d15805c32b413040e8a0fb740465acf7d85efbe741e1689a9a82c5e1e601def0

SHA512
cde3bc6dd175daa853d1c18e365df6c28b737cff5d671a6c5eba6dce12b893cb8ad8e29c1f5eea496e2f338f270bd3d6305bef2802c41ec2d78017dbc9c59aaa

Download Submit
memory/1480-18-0x0000000006D50000-0x0000000006DEC000-memory.dmp

Filesize
624KB

Download
memory/1480-16-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/1480-15-0x00000000060D0000-0x0000000006146000-memory.dmp

Filesize
472KB

Download
memory/3220-3-0x0000000005250000-0x00000000057F4000-memory.dmp

Filesize
5.6MB

Download
memory/3220-5-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3220-6-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/3220-7-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3220-11-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3220-4-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Filesize
584KB

Download
memory/3220-0-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/3220-2-0x0000000004BA0000-0x0000000004BC0000-memory.dmp

Filesize
128KB

Download
memory/3220-1-0x0000000000350000-0x00000000003E0000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads