499b29009c1d651da0c19d1a5cebd86b7a78a31df88d631f6bc3ce76d9726b3f

General

Target

3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
Size

68KB
MD5

3a7626d876f888a56546cb561740451d
SHA1

97b9f61c482b66460e720fe918df747407babbe0
SHA256

499b29009c1d651da0c19d1a5cebd86b7a78a31df88d631f6bc3ce76d9726b3f
SHA512

c236bf5f4442cc3249f0cd455c01626bb062d2b1e4657a89ce7f5c13103d741e1fb14af827a7e67adce01bed3c1e9a3f9fff74ee625e866fa377c969479f575e
SSDEEP

768:pcbHcXd06GobGyYhvzhc51bmk1IZf+j7PI77jPUpjL26YQxZNJwRLut:YHcXdwhc51bmkGMASL26YQBKut

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

pid	Process
4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vUjcMuwRtxMWrFreGcaDkCnrSrDwPMjFdWSduJeSczuYZGafnd = "C:\\Users\\Admin\\AppData\\Local\\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe"	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	vbc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4424	3176	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4424	3176	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4424	3176	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	86
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87
PID 4424 wrote to memory of 1680	4424	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Roaming\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Roaming\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe.log

Filesize
319B

MD5
600936e187ce94453648a9245b2b42a5

SHA1
3349e5da3f713259244a2cbcb4a9dca777f637ed

SHA256
1493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d

SHA512
d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964

Download Submit
C:\Users\Admin\AppData\Roaming\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Filesize
68KB

MD5
3a7626d876f888a56546cb561740451d

SHA1
97b9f61c482b66460e720fe918df747407babbe0

SHA256
499b29009c1d651da0c19d1a5cebd86b7a78a31df88d631f6bc3ce76d9726b3f

SHA512
c236bf5f4442cc3249f0cd455c01626bb062d2b1e4657a89ce7f5c13103d741e1fb14af827a7e67adce01bed3c1e9a3f9fff74ee625e866fa377c969479f575e

Download Submit
C:\Users\Admin\AppData\Roaming\aclui.dll

Filesize
17KB

MD5
e99f74ae594c1b373fa0d34193dce208

SHA1
3933f949724a6702e0038295287a39c53592b11e

SHA256
1dbb3b418bd78abb49d583f2b9cea6b20fe9fece0a59c118ddf104a672e29ebd

SHA512
355a2a3955e0f50b0c41a24589b9283892689faa61aea6360a1b762f5f2f58166c579b37dc0b003e716c1dc760f1931b73faf6fa3e2b21f8571dbdf5ee37c030

Download Submit
memory/1680-39-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1680-41-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1680-45-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3176-2-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3176-18-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3176-1-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/3176-0-0x0000000074AA2000-0x0000000074AA3000-memory.dmp

Filesize
4KB

Download
memory/4424-19-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4424-30-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4424-42-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads