87f95cf06cf4aca5be6bcf8e85ec2592611db73e32b703f6802b9679145f1f1a

General

Target

178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
Size

91KB
MD5

178ae9ec0d28ecbd42dec28de30376c5
SHA1

1d6ee629611b7e11fadb5153e214b9784cf9a950
SHA256

87f95cf06cf4aca5be6bcf8e85ec2592611db73e32b703f6802b9679145f1f1a
SHA512

c95e636fa0e1664a68fec663b14b296b5caa84788e9949627a3a51cb0f9ed7e155bb22edfea412ef819783d54fcc91d6348d1ebad628038f3a8c0b6573667df6
SSDEEP

1536:ZiDLG7z8p+SZjBHdEhIxBtS5Q5grdU3+kNS9Y/bmF6uIo6nX7mNeomBZzJ1J+B00:ZifEzyPHdEaaQ5g2Ow2Y/bmF65NCNeoR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	jusched.exe

Executes dropped EXE 2 IoCs

pid	Process
1212	jusched.exe
5008	jusched.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4128 set thread context of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 1212 set thread context of 5008	1212	jusched.exe	95

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
2024	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 4128 wrote to memory of 2024	4128	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	83
PID 2024 wrote to memory of 1212	2024	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	94
PID 2024 wrote to memory of 1212	2024	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	94
PID 2024 wrote to memory of 1212	2024	178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe	94
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 1212 wrote to memory of 5008	1212	jusched.exe	95
PID 5008 wrote to memory of 3092	5008	jusched.exe	96
PID 5008 wrote to memory of 3092	5008	jusched.exe	96
PID 5008 wrote to memory of 3092	5008	jusched.exe	96

C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
      "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Program Files (x86)\Common Files\Java\Java Update\jusched .exe
        
        "C:\Program Files (x86)\Common Files\Java\Java Update\jusched .exe" "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" DEL:C:\Users\Admin\AppData\Local\Temp\178ae9ec0d28ecbd42dec28de30376c5_JaffaCakes118.exe
        5⤵
        
        PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Filesize
91KB

MD5
b17e4c7639b11b84a691f7564b9056ee

SHA1
70ff7b5dac62fbf006a8dc92d0611ed0094a1a12

SHA256
d5078bddb667fd46fe913ab851c2f8dbc567fdd14e6b1c098a97896c66876b90

SHA512
4814efa76a98188618a7a0899a3cccc2f0b5180b0ee25b1230b2e987e5a8a5bf29c4241f538cfc1650d5567c99f0c5bc586dd0f43eb3a7cb7d8175bbba30b2c1

Download Submit
memory/2024-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2024-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2024-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5008-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing