0c7e9920983646b161398684952756acd110b553399e1e09576a298e67a01c2e

General

Target
a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe
Size 1.6MB
Sample240613-h9rydatarr
SHA256 0c7e9920983646b161398684952756acd110b553399e1e09576a298e67a01c2e
MD5 a46a35087043465cd45fb6ed6371f656
SHA1 69506af0588e13595122bec6d535ed26af94e861
SHA512 272b63571f30a1bf342cc17fe7cc6ff875b8da79df3e01449d274e000f9cc1911a0a966c9a9fc537d952149a3cf39fbd41d08dbae02f63f9cdb319cbbbc41950
SSDEEP 49152:dJwukiAFOrk6TXh1/7xUOLRTlpS+JOiwKTH93:dO6Tx1DL4NM
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4008	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe
728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe
728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe
728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 4760	728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe	86
PID 728 wrote to memory of 4760	728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe	86
PID 728 wrote to memory of 4760	728	a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe	86
PID 4760 wrote to memory of 4008	4760	cmd.exe	88
PID 4760 wrote to memory of 4008	4760	cmd.exe	88
PID 4760 wrote to memory of 4008	4760	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a46a35087043465cd45fb6ed6371f656_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\31039.bat" "C:\Users\Admin\AppData\Local\Temp\46A34454DC4A4BDC9498664ECCD947C7\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 1000
    3⤵
    - Runs ping.exe
    PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31039.bat

Path C:\Users\Admin\AppData\Local\Temp\31039.bat
Size 212B
SHA256 cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d
MD5 668767f1e0c7ff2b3960447e259e9f00
SHA1 32d8abf834cce72f5e845175a0af2513b00504d8
SHA512 c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680
MD5 SHA1 SHA512

Submit Download

46A34454DC4A4BDC9498664ECCD947C7_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\46A34454DC4A4BDC9498664ECCD947C7\46A34454DC4A4BDC9498664ECCD947C7_LogFile.txt
Size 2KB
SHA256 0eee0e6d1fffd1b4d9fa04b162cdd281be75e2bb3e83b05b008087646e358edb
MD5 ac3d237d0cf2a530d9289f8431408a33
SHA1 b483197d44fe662606d1c61060f9d5763e051139
SHA512 1f6cf6777957e3038050d7d32eb25c6e814b22f6e804a9ccfcd84a102a733fa4e3af148cface497c5b69fb6172aa7a0eb97c184c3c593be9f62937c47e97f64c
MD5 SHA1 SHA512

Submit Download

46A34454DC4A4BDC9498664ECCD947C7_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\46A34454DC4A4BDC9498664ECCD947C7\46A34454DC4A4BDC9498664ECCD947C7_LogFile.txt
Size 9KB
SHA256 0a81148e1f3cc319e508a54007c9f2c272ed65fd3cf864a79218362c17bc00f2
MD5 3974067cd32aa52dbdfdb1efbc72ac6f
SHA1 7e763cb6679b311b5182fa6de4ad267c9eb197dc
SHA512 cd92c272fa3f2a0f8e22e36720646b5e52ba9757091c440da05dac78701188751b359e470f33659244e1c920de267aefc1d623724206f1cfb3dba865dc0344e0
SSDEEP 192:Dj0a0dtTwErdU6mrgyE1O17181/1OU1OD171r1ds1K:Dj0a0dtT7rdU6mrgyE1O17181/1OU1OV
MD5 SHA1 SHA512 SSDEEP

Submit Download

46A34454DC4A4BDC9498664ECCD947C7_LogFile.txt

Path C:\Users\Admin\AppData\Local\Temp\46A34454DC4A4BDC9498664ECCD947C7\46A34454DC4A4BDC9498664ECCD947C7_LogFile.txt
Size 666B
SHA256 e6594df4914dc43df39ddf4a727f0c224fd4a15a5222bceee6a5dcd928099bc3
MD5 8a8b32e0114a39a69b5b6faba5efccdd
SHA1 41ea2ae924bc8a9ff8d5479b27e365b15720aea2
SHA512 46e37de8f05a3622f804db50ecab137d793cb6dad94778e5f8b6da10b3d14c214ba5ce199da1a7e9dd5519e12186c4a8581b301e7c756bfdc3282a298a459e63
MD5 SHA1 SHA512

Submit Download

46A344~1.TXT

Path C:\Users\Admin\AppData\Local\Temp\46A34454DC4A4BDC9498664ECCD947C7\46A344~1.TXT
Size 118KB
SHA256 16d2271a81b210303a5df61057409b46debf366ae73b07616cd4c746915224e7
MD5 d3e28509ee670f01bd4df99b53dc8024
SHA1 52964052638816999651787210d4ea69b474ddc1
SHA512 e2f92b6bffaa5091ac213bac510f31d310f73403a1aafffb32730d926a371076c2a3d6f99e9f66b0b7819e412f107214740ebe7c447a19406ca102c7eb88bade
SSDEEP 768:w1O17181/1OU1OD171r1C1p141E1yo11P151g11+XEv1gg1ZU1KV1w1w1a1Vf1VE:vqtkqSoBrnr0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/728-63-0x0000000003220000-0x0000000003221000-memory.dmp

Download

memory/728-156-0x0000000003220000-0x0000000003221000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads