993eb1738b0dfe8dc45c7fbc6ae708bcfb9d7715c1b7af9c76607f37d2b78439

General

Target

2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe
Size

784KB
MD5

2c2bd06b621c687498b4dc180d396310
SHA1

f23d366641cce0768de31f9cc7654edca9050d44
SHA256

993eb1738b0dfe8dc45c7fbc6ae708bcfb9d7715c1b7af9c76607f37d2b78439
SHA512

fcbd9111528c0955b7b8aee7cd38d1b8f6a86c77c62c5e9008821e2acf6193e4089e1fedcabfe8e3fbab016c8b118e104b1d13beca5d053c97e110a8bb882fd5
SSDEEP

12288:dHRN2V/TP2Wh43o4rroMjXfziLW8uJgtoPS038JvQIvJbxHBjGtU:dHaVrPb43ogrrsO9Ke8lQ0DhQ

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
380	lol1.exe
3532	lol2.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023449-16.dat	upx
behavioral2/memory/3532-21-0x0000000000400000-0x000000000060E000-memory.dmp	upx
behavioral2/memory/3532-27-0x0000000000400000-0x000000000060E000-memory.dmp	upx
behavioral2/memory/3532-28-0x0000000000400000-0x000000000060E000-memory.dmp	upx
behavioral2/memory/3532-30-0x0000000000400000-0x000000000060E000-memory.dmp	upx
behavioral2/memory/3532-36-0x0000000000400000-0x000000000060E000-memory.dmp	upx
behavioral2/memory/3532-41-0x0000000000400000-0x000000000060E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	380	WerFault.exe	82

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3532	lol2.exe
3532	lol2.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3532	lol2.exe
3532	lol2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3532	lol2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 380	4468	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe	82
PID 4468 wrote to memory of 380	4468	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe	82
PID 4468 wrote to memory of 380	4468	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe	82
PID 4468 wrote to memory of 3532	4468	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe	83
PID 4468 wrote to memory of 3532	4468	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe	83
PID 4468 wrote to memory of 3532	4468	2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c2bd06b621c687498b4dc180d396310_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\lol1.exe
  "C:\Users\Admin\AppData\Local\Temp\lol1.exe"
  2⤵
  - Executes dropped EXE
  PID:380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 264
    3⤵
    - Program crash
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\lol2.exe
  "C:\Users\Admin\AppData\Local\Temp\lol2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 380 -ip 380
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lol1.exe

Filesize
15KB

MD5
cd70dfe50925abca0a4005a30f8892f2

SHA1
8fd771207cf4e5facd5d43acabc2624220ed6169

SHA256
3bbb53d32ee0d2092c5b67cf6e34681bf35bfa958edbfa31eebb5ba96495d7ea

SHA512
c5de658756e91c1b4e987ead1d60d768e621f52830f801f322a0518ed638cf6ddb65a4f835ef6bfe9baf2f3673908580eaea46a639126f6e8503466922aa6883

Download Submit
C:\Users\Admin\AppData\Local\Temp\lol2.exe

Filesize
742KB

MD5
624009ff4e70ff7ea114c840b8bf37c8

SHA1
0dbd383b57c73abe8897ae86e381216c6bc1bd20

SHA256
23b87d956e0786b57550f50c173ffd5ecd0f7b2361251e9c681dce66904b0a7d

SHA512
cff0df27f59253b7c41683394cb7960efeb554d04f2dd7c2fb4d9d9bc1993d497625c9313f188ac46d767d4c6904ffcf06f64965f83388badad2b9d57723c707

Download Submit
memory/380-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/380-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3532-28-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/3532-21-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/3532-24-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/3532-27-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/3532-29-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/3532-30-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/3532-36-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/3532-41-0x0000000000400000-0x000000000060E000-memory.dmp

Filesize
2.1MB

Download
memory/4468-5-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download
memory/4468-2-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download
memory/4468-23-0x00007FFC17D70000-0x00007FFC18711000-memory.dmp

Filesize
9.6MB

Download
memory/4468-1-0x000000001B1E0000-0x000000001B286000-memory.dmp

Filesize
664KB

Download
memory/4468-0-0x00007FFC18025000-0x00007FFC18026000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing