e02121138494c3d9dd2fd562645cc3ac1eafa1f28c8fe8e7f2c072f80734e5ad

General

Target

00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe
Size

2.3MB
MD5

00b90a228239015a6ae5e91f645300af
SHA1

0b94ebb85712d03a5b4f545833a055420a23e321
SHA256

e02121138494c3d9dd2fd562645cc3ac1eafa1f28c8fe8e7f2c072f80734e5ad
SHA512

9fd2054d4341d703a66d93d6aa58de0a2f2113e6dcea0eccb5082d5a6b36e22a4cc96df8df0921b744fec12e5a3651f00ecce53826c9a9ba2fb2fcd5daa5e54e
SSDEEP

49152:fDfK+gW5pdhoi11+qkPmMbi+Ncu87dlzhDhgMMMZMMMACh43Dp/wPHv:fDfz33dhR11Rkg7NeMMMZMMMACh431/G

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
3224	KartRider.exe
4460	Server_Setup.exe
3160	Hacker.com.cn.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\KartRider.exe	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe
File opened for modification	C:\Windows\KartRider.exe	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe
File created	C:\Windows\Server_Setup.exe	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe
File opened for modification	C:\Windows\Server_Setup.exe	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe
File created	C:\Windows\Hacker.com.cn.exe	Server_Setup.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	Server_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
212	4400	WerFault.exe	90
3660	4400	WerFault.exe	90
1640	4400	WerFault.exe	90

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	Server_Setup.exe
Token: SeDebugPrivilege	3160	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3160	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3224	4400	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe	91
PID 4400 wrote to memory of 3224	4400	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe	91
PID 4400 wrote to memory of 3224	4400	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe	91
PID 4400 wrote to memory of 4460	4400	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe	92
PID 4400 wrote to memory of 4460	4400	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe	92
PID 4400 wrote to memory of 4460	4400	00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe	92
PID 3160 wrote to memory of 2376	3160	Hacker.com.cn.exe	97
PID 3160 wrote to memory of 2376	3160	Hacker.com.cn.exe	97

C:\Users\Admin\AppData\Local\Temp\00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00b90a228239015a6ae5e91f645300af_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\KartRider.exe
  "C:\Windows\KartRider.exe"
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\Server_Setup.exe
  "C:\Windows\Server_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1268
  2⤵
  - Program crash
  PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1312
  2⤵
  - Program crash
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1040
  2⤵
  - Program crash
  PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400
1⤵
PID:2804

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4400 -ip 4400
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4400 -ip 4400
1⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\KartRider.exe

Filesize
1.6MB

MD5
231d94d7d3b781f974846d2d8809ce55

SHA1
c90e9ddf6e08d0804161783275fe2a70b2b3cba8

SHA256
68e9814ff7e3095eb6efe0449005baeedd98feedf94fd95a1a54a33cb28983ac

SHA512
e97b2f68cdcded9edddbf4384ee878fca14edc753bfe7f35f7a0ec145351a010a565e958e74f303b64b4eabd290c56e6e7c389181a56acc8b2844218553a9c2b

Download Submit
C:\Windows\Server_Setup.exe

Filesize
743KB

MD5
6860e48870281c5773da51c8639eb85b

SHA1
5a461e8a1960f26794c0e770805dda188e3526bc

SHA256
eb87882a1d7cd501c13d19be7b28be404461cdc6ba7aaee8e37cf590b5ca6232

SHA512
60836ea884b0e2be2567ed425038407c27dcaf082d3e722abcd7489661fbadd756be9cb36e58cab6bbccfe61a92c576d5cb611fb2f21787d8a3aeb36223f36c3

Download Submit
memory/3160-101-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3160-102-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3160-106-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4400-93-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4460-94-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4460-99-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing