def0fabc71f047d834e179ae6db5aa142e0de2c2ee427f33f3107c1e68915623

General

Target

000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
Size

68KB
MD5

000eb495f39d8cdae4b8b2de869d14fe
SHA1

03b50cd21bf8712b5854afd915308786794e46ad
SHA256

def0fabc71f047d834e179ae6db5aa142e0de2c2ee427f33f3107c1e68915623
SHA512

4be3d20d838f4c85299feeeb8762c7f3274d03bfec5309b2b8bf8fa92cef8f1573708ffd940395aef959103d72f1aee00b9fb621074bae571fe9df312f7daefe
SSDEEP

1536:r1BvK2hM46fGBCzSfNNI6yx8Hoh3eypmrYbwWoR:r1BvK7pmCzSlNILr7mrlR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	jusched.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4216	jusched.exe
224	jusched.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 4216 set thread context of 224	4216	jusched.exe	93

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 1312 wrote to memory of 388	1312	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	83
PID 388 wrote to memory of 4216	388	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	92
PID 388 wrote to memory of 4216	388	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	92
PID 388 wrote to memory of 4216	388	000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe	92
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 4216 wrote to memory of 224	4216	jusched.exe	93
PID 224 wrote to memory of 1628	224	jusched.exe	96
PID 224 wrote to memory of 1628	224	jusched.exe	96
PID 224 wrote to memory of 1628	224	jusched.exe	96

C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
      "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Program Files (x86)\Common Files\Java\Java Update\jusched .exe
        
        "C:\Program Files (x86)\Common Files\Java\Java Update\jusched .exe" "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\000eb495f39d8cdae4b8b2de869d14fe_JaffaCakes118.exe
        5⤵
        
        PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Filesize
68KB

MD5
fab91f7159951acff75af18bb86c914e

SHA1
8fde9003e4dd9456f90c65a26eb39d62691c060f

SHA256
ff614d1f9287492259720296ea39ea223fb105bdf775e75f12531702caedf8e7

SHA512
51e2026222a08458ecc1f81b360d1460d41db00c201ba114759e659025ed5529209323edff42d3e7361a50d06cb9d0a382b04a4d5a31212fe0163c58b810504b

Download Submit
memory/224-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/388-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/388-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/388-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing