0b8df9acd2c4a4b71bc2b36658ca4ba64796558638617c60dde99a7d90e8d44e

General

Target

261ed78771712636bdea029967952eba_JaffaCakes118.exe
Size

645KB
MD5

261ed78771712636bdea029967952eba
SHA1

6ba2075886daf5a105efb531958e595834d6c8ef
SHA256

0b8df9acd2c4a4b71bc2b36658ca4ba64796558638617c60dde99a7d90e8d44e
SHA512

47e752d959cd16cf2cfd94a6c6a6be9cdf509deb7c5431d221f7c22a04799fdc877c1db246e87465810f86f146d0e83078e5b7dca6752b5f87cbd3d72236b8bc
SSDEEP

12288:vGNbiT94+gia2afU4t8LzbDWJNPhJJ+SJawtuRK0OiihazZhqjEBbqoIJPj:ebajgUavmLz2jvJLmEN6ZOFx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation	261ed78771712636bdea029967952eba_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 4848	1032	261ed78771712636bdea029967952eba_JaffaCakes118.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	4848	WerFault.exe	82

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000_Classes\Local Settings	261ed78771712636bdea029967952eba_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1100	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1100	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	4068	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4068	AUDIODG.EXE
Token: 33	1100	vlc.exe
Token: SeIncBasePriorityPrivilege	1100	vlc.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe
1100	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1100	vlc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 4848	1032	261ed78771712636bdea029967952eba_JaffaCakes118.exe	82
PID 1032 wrote to memory of 4848	1032	261ed78771712636bdea029967952eba_JaffaCakes118.exe	82
PID 1032 wrote to memory of 4848	1032	261ed78771712636bdea029967952eba_JaffaCakes118.exe	82
PID 1032 wrote to memory of 4848	1032	261ed78771712636bdea029967952eba_JaffaCakes118.exe	82
PID 1032 wrote to memory of 4848	1032	261ed78771712636bdea029967952eba_JaffaCakes118.exe	82
PID 4848 wrote to memory of 1100	4848	261ed78771712636bdea029967952eba_JaffaCakes118.exe	84
PID 4848 wrote to memory of 1100	4848	261ed78771712636bdea029967952eba_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\261ed78771712636bdea029967952eba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\261ed78771712636bdea029967952eba_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\261ed78771712636bdea029967952eba_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\261ed78771712636bdea029967952eba_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\'s Symphony No. 9 (Scherzo).wma"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1464
    3⤵
    - Program crash
    PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4848 -ip 4848
1⤵
PID:3736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x440 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\'s Symphony No. 9 (Scherzo).wma

Filesize
599KB

MD5
f2271fe569c058dc724d9b9e53811e31

SHA1
ea276fc14127875413ac387f017bd2291a987f4b

SHA256
bf0074851e2435a255b512e502b831ed2c456774971f8fc57004d597769364a6

SHA512
c324428534f64879aa17b190206e538066308486d95e9fa1b8b7238bc79067042717c232034ef8926376b72d3123be169852b05bfe58c7f69887245d91e5b53d

Download Submit
memory/1100-19-0x00007FFE208A0000-0x00007FFE208B7000-memory.dmp

Filesize
92KB

Download
memory/1100-16-0x00007FFE25B50000-0x00007FFE25B68000-memory.dmp

Filesize
96KB

Download
memory/1100-13-0x00007FF71B5F0000-0x00007FF71B6E8000-memory.dmp

Filesize
992KB

Download
memory/1100-14-0x00007FFE20790000-0x00007FFE207C4000-memory.dmp

Filesize
208KB

Download
memory/1100-21-0x00007FFE20660000-0x00007FFE2067D000-memory.dmp

Filesize
116KB

Download
memory/1100-22-0x00007FFE20640000-0x00007FFE20651000-memory.dmp

Filesize
68KB

Download
memory/1100-20-0x00007FFE20770000-0x00007FFE20781000-memory.dmp

Filesize
68KB

Download
memory/1100-24-0x00007FFE205F0000-0x00007FFE20631000-memory.dmp

Filesize
260KB

Download
memory/1100-23-0x00007FFE11040000-0x00007FFE1124B000-memory.dmp

Filesize
2.0MB

Download
memory/1100-61-0x00007FFE0FF90000-0x00007FFE11040000-memory.dmp

Filesize
16.7MB

Download
memory/1100-25-0x00007FFE0FF90000-0x00007FFE11040000-memory.dmp

Filesize
16.7MB

Download
memory/1100-17-0x00007FFE249C0000-0x00007FFE249D7000-memory.dmp

Filesize
92KB

Download
memory/1100-18-0x00007FFE24910000-0x00007FFE24921000-memory.dmp

Filesize
68KB

Download
memory/1100-15-0x00007FFE11440000-0x00007FFE116F6000-memory.dmp

Filesize
2.7MB

Download
memory/1100-30-0x00007FFE20040000-0x00007FFE20051000-memory.dmp

Filesize
68KB

Download
memory/1100-29-0x00007FFE20440000-0x00007FFE20451000-memory.dmp

Filesize
68KB

Download
memory/1100-28-0x00007FFE20460000-0x00007FFE20471000-memory.dmp

Filesize
68KB

Download
memory/1100-27-0x00007FFE20480000-0x00007FFE20498000-memory.dmp

Filesize
96KB

Download
memory/1100-26-0x00007FFE205C0000-0x00007FFE205E1000-memory.dmp

Filesize
132KB

Download
memory/4848-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4848-1-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing