ce46a492a3abc1faab1e4a6e3ae430b8c68b858cba204d7a86f16bba19683661

General

Target

189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
Size

74KB
MD5

189851836e7c3c836a36cbd4e5d00dce
SHA1

e1ceb793467c8fb1442a3e3a581c4151275559dd
SHA256

ce46a492a3abc1faab1e4a6e3ae430b8c68b858cba204d7a86f16bba19683661
SHA512

b7caeb94c2a7e6cba9073ced87de0ad425dd0a212af5b2698ed8c2958b5be51596d514d875eb227fb6c9f3503a0ed916fa3926cbd4a2587ebb5eb6af911d9e89
SSDEEP

1536:t0JUpReIXnb72L31MPuH/i9cPdbZdDc7rqUDJxjayej6mQ9:txSI3/2Dfq9cPdIDJxGyH9

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
3264	rundl32.exe
60	rundl32.exe
3772	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rundll32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe"	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 60	3264	rundl32.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
548	3308	WerFault.exe	87
4864	60	WerFault.exe	101
3904	3772	WerFault.exe	103

Runs net.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1240	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	94
PID 3308 wrote to memory of 1240	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	94
PID 3308 wrote to memory of 1240	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	94
PID 1240 wrote to memory of 1064	1240	net.exe	98
PID 1240 wrote to memory of 1064	1240	net.exe	98
PID 1240 wrote to memory of 1064	1240	net.exe	98
PID 3308 wrote to memory of 3264	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	100
PID 3308 wrote to memory of 3264	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	100
PID 3308 wrote to memory of 3264	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	100
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3264 wrote to memory of 60	3264	rundl32.exe	101
PID 3308 wrote to memory of 3772	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	103
PID 3308 wrote to memory of 3772	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	103
PID 3308 wrote to memory of 3772	3308	189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe	103

C:\Users\Admin\AppData\Local\Temp\189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\189851836e7c3c836a36cbd4e5d00dce_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3308
- C:\windows\SysWOW64\net.exe
  "C:\windows\system32\net.exe" stop wscsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 924
  2⤵
  - Program crash
  PID:548
- C:\Users\Admin\AppData\Local\Temp\rundl32.exe
  "C:\Users\Admin\AppData\Local\Temp\rundl32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Users\Admin\AppData\Local\Temp\rundl32.exe
    "C:\Users\Admin\AppData\Local\Temp\rundl32.exe"
    3⤵
    - Executes dropped EXE
    PID:60
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 12
      4⤵
      Program crash
      PID:4864
- C:\Users\Admin\AppData\Local\Temp\rundll32.exe
  "C:\Users\Admin\AppData\Local\Temp\rundll32.exe"
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 544
    3⤵
    - Program crash
    PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 3308
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 60 -ip 60
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3772 -ip 3772
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rundl32.exe

Filesize
22KB

MD5
9b317cf75128dae3257f5c9988092953

SHA1
546565818b33ba4037daf36f86a892deefa719a6

SHA256
6e84427e3d38c26da42eb64c209ec615caa7f62d73b0bda9f2c9ab530513221d

SHA512
0c7d3a6c3e679797cc2cb5e15c634544c6c9dccd9c1772a8227a9895a6b09759fe6c373767f082f2b7e21f5a619cda07078011697040ca6c3cf4b4ce19f5d0c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundll32.exe

Filesize
36KB

MD5
fe7285a11b8ef5158383b3fcc3a63fb1

SHA1
f3aacd6ae45e24c593883a1109dd6fcb6ac8e7a6

SHA256
c9a2ee86e317978b235483bbf55b3b1c4b9aa2a4ed127a1f73ccc72e06ba17ae

SHA512
4ad5832042bbcbf8a35522d9f871338a6d5341d9f2cea5cbb5f0b67d48defa05dd80d5353bc6395e84e52d759c144cddde48bc411c4fb25f44bbb87c99fd1628

Download Submit
memory/60-9-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/60-10-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/3264-8-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/3264-13-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/3772-22-0x0000000000100000-0x000000000010B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads