3e4e4b7c305b2f4e43ddc81bd06b364138a122a476419cd54c2e624d359584d9

General

Target

27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe
Size

903KB
MD5

27b06b55ed6b50ad7df0d74062bd61c8
SHA1

293194543a2fa5b156fa42455a31e03e3be5718c
SHA256

3e4e4b7c305b2f4e43ddc81bd06b364138a122a476419cd54c2e624d359584d9
SHA512

a68e1750faaf027ee43a12e5fc7c8e4ca3c8fe7d0534e0e09032d9ee9f521566c2f0d3482e449a234495d7e3d4f59f04d8b5ce365c322b68110d22b786741247
SSDEEP

12288:YwG7ARCTY01Jklgo7F4uK5Iu2QFh9U73S7lCCsvs1val5JIk+CTK5+ZNAc7y:pGEUTY00NklCCsk1va5V+S6+ZicO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4420	gyz8jnrs28eOgQIlcNj7.exe
5072	Xj4pTdeXQSpULVHhrpZH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3328	5072	WerFault.exe	94

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3572	WINWORD.EXE
3572	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe
3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE
3572	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4420	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	92
PID 3696 wrote to memory of 4420	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	92
PID 3696 wrote to memory of 4420	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	92
PID 3696 wrote to memory of 3572	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	93
PID 3696 wrote to memory of 3572	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	93
PID 3696 wrote to memory of 5072	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	94
PID 3696 wrote to memory of 5072	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	94
PID 3696 wrote to memory of 5072	3696	27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27b06b55ed6b50ad7df0d74062bd61c8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Users\Admin\AppData\Local\Temp\gyz8jnrs28eOgQIlcNj7.exe
  "C:\Users\Admin\AppData\Local\Temp\gyz8jnrs28eOgQIlcNj7.exe"
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\zEryfGozDh3rRt8azR7e.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3572
- C:\Users\Admin\AppData\Local\Temp\Xj4pTdeXQSpULVHhrpZH.exe
  "C:\Users\Admin\AppData\Local\Temp\Xj4pTdeXQSpULVHhrpZH.exe"
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 224
    3⤵
    - Program crash
    PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5072 -ip 5072
1⤵
PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3060,i,7252135083366563450,1411796122645726339,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Xj4pTdeXQSpULVHhrpZH.exe

Filesize
605KB

MD5
858bfdb8bff24d8dec5f30922478d050

SHA1
6274279654efe4452d667801c72a79540da651e8

SHA256
f870bfc697124b09e3a63b618c8969015925f0a34d73ed3c15fb1fe9dab7f34b

SHA512
a668e5654b0e705942223a680c35db59338ea7274be4ea40adf23407afed0c62682c020e5d3fc647e62523228516ac9d506c9efb8f5676245288fd9c9b7ad193

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyz8jnrs28eOgQIlcNj7.exe

Filesize
82KB

MD5
3371e72d3d19690e36849819fb385ed0

SHA1
1eca9e1d3fe82fcbb73cbd1053fc5f446e9367e2

SHA256
501bc48439cb0d6afc23fa79459c8055d3e31a540fc4f7e59c21fd9c33211cb9

SHA512
7066796c72ade31f67fb395175588a5a445a9aa96846eb27c07bbfff163cac3403fa7f28aaf16a765794adf4871e13a99aa9fa42324cd0ae8b981c44cb85b101

Download Submit
C:\Users\Admin\AppData\Local\Temp\zEryfGozDh3rRt8azR7e.doc

Filesize
184KB

MD5
b4275bf83f912977607e0ed1fde885fb

SHA1
229d0ab0a09da5bc536dac1d4a4d251f196529be

SHA256
39be1f33995034a259fc76359308a8c9a23d2582b445fbc5c1d349cd21b98351

SHA512
962844dc760549fb7855b326000f7f389d6858b50f776a79210ba596091ad6444cbf23b6cff0ab42a815ee54e6d7fb48520841b70e5dd11c8ae27a9223b01574

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
6da8e7176d2b54f1ffd144cc7cb9c2cc

SHA1
dc1490944ea23b8d9d8c327bd676f3fbd42a70b2

SHA256
64af194196489ce04ecc9633e696906095bc5664110f212638ee677ea25c0bbe

SHA512
8d39f4c3b1ba460702fd2603d56f06d3ad0df02e212f07d5935af66ca01af5f8b09e415262f599e0fa118b5c068561ba36fde536244df67cbaf529068d8fc233

Download Submit
memory/3572-35-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-32-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-26-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-25-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-28-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-30-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-31-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-36-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-27-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-37-0x00007FFAF0030000-0x00007FFAF0040000-memory.dmp

Filesize
64KB

Download
memory/3572-33-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-29-0x00007FFB3282D000-0x00007FFB3282E000-memory.dmp

Filesize
4KB

Download
memory/3572-34-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-39-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-38-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-40-0x00007FFAF0030000-0x00007FFAF0040000-memory.dmp

Filesize
64KB

Download
memory/3572-77-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-55-0x00007FFB32790000-0x00007FFB32985000-memory.dmp

Filesize
2.0MB

Download
memory/3572-73-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-74-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-76-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/3572-75-0x00007FFAF2810000-0x00007FFAF2820000-memory.dmp

Filesize
64KB

Download
memory/4420-9-0x0000000000400000-0x0000000000406600-memory.dmp

Filesize
25KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads