4131e9f2b01a1b6d3c904e60c93879d361d4de42c7d42ba7df3bf7f02014f890

General

Target

2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
Size

283KB
MD5

2d0ff4c89c57d2286dd0f8fd3834b35e
SHA1

0589f72478e0b36328ad4520ad909023255c17f8
SHA256

4131e9f2b01a1b6d3c904e60c93879d361d4de42c7d42ba7df3bf7f02014f890
SHA512

f652c5821c88d9482ca24b164015a511b0790b28b7d9258b2e0e83b494c09d896c87fa7fc5c1b5057043f5925853922b8b81314bd6a28900a091f8ed36938fab
SSDEEP

6144:Je34ZNsIz5JsNdtdBG5aQFN2NY5EtHfZIux0MB8MVWIhnvRRLT:nj5JsNdtdBYIYO/ZIuxvnvRRn

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Loads dropped DLL 5 IoCs

pid	Process
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4460	4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe	95
PID 4532 wrote to memory of 4460	4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe	95
PID 4532 wrote to memory of 4460	4532	2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d0ff4c89c57d2286dd0f8fd3834b35e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\ŠÂ‹«î•ñ_dracuriot.txt
  2⤵
  PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz4FC2.tmp\DiagSummary.dll

Filesize
96KB

MD5
a293e99fd5576dc0f91666d4cd905a5c

SHA1
77b50d862e06a1eb12c94c5f5d6d7c7c1a3a5360

SHA256
123d4c7037deb56842b4199eefede319f0298e1d98e052e60c302cc2b17b2c37

SHA512
78bbdce55e60c9760551bee9a76a4115cbe1b004f05992f44f275bbb3416f0ecc0355f805da24561fb113f485b1e13dfc417c93d3842e82e4117f8b52875463f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz4FC2.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz4FC2.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz4FC2.tmp\iocustom.ini

Filesize
315B

MD5
34e435a988c1dd27eef6583a643338dd

SHA1
0e9a0635a438438507a773a592e62706e900d82d

SHA256
5fb5344bd032f03389326ac8c5180d379a679f87fb3253a7a81d0e983567e91d

SHA512
82c71035c8aec72ad29e6be01cab1d872d3892f77bb99a252f062435de65d0cdb50f73fd7896e9aa805b183662a7cd3edc4caa8c176dbaeba5011d9458ea8a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz4FC2.tmp\iocustom.ini

Filesize
365B

MD5
3e4df319de004180ac2e6eeda0e0151d

SHA1
cbbeff81e428a034cb098887ed1fe75e3eab7093

SHA256
2f758d27264806c13548b95114729a508820fdd40c4b37d6b09f2ed607e0768e

SHA512
cb18205308b1a2adece4291011a98d7de5cb519648f3932a62baae7b9e997a001ea723052207dcb14ddfaccf8d7c7fd82fcc6a56746faea0e6bfccdefbc22e2a

Download Submit
C:\Users\Admin\Documents\ŠÂ‹«î•ñ_dracuriot.txt

Filesize
8KB

MD5
20a2cee5c000131b7553a3c9b5431068

SHA1
63ecdc72b29bb6caa53ff9f8513153abde9cdb93

SHA256
136246ad813f2f040901103aaa673b8fd2a78f5cfbd7390fae95fe2519021cee

SHA512
d438455a15b257dbe4715f4a5bb34c51a2cf03ed7086cd26f350ff3e765c386a7deb097b182b3a062468ae7e1246c85ad63043fe7a073f4d21fec10e10f0add8

Download Submit
memory/4532-99-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-88-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-89-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-98-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-97-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-96-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-95-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-94-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-93-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-87-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4532-84-0x0000000004AD0000-0x0000000004AEA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads