d03265d96d07dabca21327a9295899cd6e8009a6f2da2e0dc7848d2fbf0982d3

General

Target

468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe
Size

356KB
MD5

468e8b371933c19752e927b2a9d09546
SHA1

e904bf6466c3562531e0a148f8b72c3d732b63e7
SHA256

d03265d96d07dabca21327a9295899cd6e8009a6f2da2e0dc7848d2fbf0982d3
SHA512

246bd2aceb0f5bdcd6265304ccf75f936711cff5aeb8ea21d91e6e22dc5f4db0d9b0242978684216983a2a304f5c6747eeed676f5900412f4130e3639404ab83
SSDEEP

3072:gEXroutKmHkgFh782f/Bh6mUMDc0whM27TWob3ae6naElN:gYroSKd2NqfPysdjQN

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
1524	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4092-0-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4092-13-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\win.ini	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 1524	4092	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	86
PID 4092 wrote to memory of 1524	4092	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	86
PID 4092 wrote to memory of 1524	4092	468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe	86
PID 1524 wrote to memory of 4076	1524	b2e.exe	87
PID 1524 wrote to memory of 4076	1524	b2e.exe	87
PID 1524 wrote to memory of 4076	1524	b2e.exe	87
PID 4076 wrote to memory of 3680	4076	cmd.exe	90
PID 4076 wrote to memory of 3680	4076	cmd.exe	90
PID 4076 wrote to memory of 3680	4076	cmd.exe	90
PID 4076 wrote to memory of 3176	4076	cmd.exe	91
PID 4076 wrote to memory of 3176	4076	cmd.exe	91
PID 4076 wrote to memory of 3176	4076	cmd.exe	91
PID 4076 wrote to memory of 4832	4076	cmd.exe	92
PID 4076 wrote to memory of 4832	4076	cmd.exe	92
PID 4076 wrote to memory of 4832	4076	cmd.exe	92
PID 4076 wrote to memory of 1008	4076	cmd.exe	93
PID 4076 wrote to memory of 1008	4076	cmd.exe	93
PID 4076 wrote to memory of 1008	4076	cmd.exe	93

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3176	attrib.exe
4832	attrib.exe
1008	attrib.exe
3680	attrib.exe

C:\Users\Admin\AppData\Local\Temp\468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\704E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\704E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\704E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\468e8b371933c19752e927b2a9d09546_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7232.tmp\batchfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\autoexec.bat
      4⤵
      Views/modifies file attributes
      PID:3680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\boot.ini
      4⤵
      Views/modifies file attributes
      PID:3176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\ntldr
      4⤵
      Views/modifies file attributes
      PID:4832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -s -h c:\windows\win.ini
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\704E.tmp\b2e.exe

Filesize
10KB

MD5
eb7ac023e0d91083b2b19c50398f21a8

SHA1
98d4bc67d0d97ac12ef0c985d2f8bc2bdda6f816

SHA256
5c53dda02f5769338a498f47629428b0e4a8ace839e4a6317638743179f842bb

SHA512
7f93207c81eee978cd9e845f656f733d00e3a78acd22c12710ae9cdcee7197fa6736e9a7c7e0411481cdc75519e35aa26cd7dbe4aa185885c068370e27c0362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7232.tmp\batchfile.bat

Filesize
856B

MD5
64b23eb863f42552ba617b9b41aef88c

SHA1
bdb311c81fe60fc51409d75588a6f5206f18aa0a

SHA256
d2d5c13c364aeb5fadce9a5c954f81630b867ed802364876ac2f8ebc22d8f018

SHA512
afe0cb0545bc79e1ff1f2856b09302ccad6ec0a74f0a3aefdb566eb0442060ebf6a74d7a9c51018453a9ab2b7e9613455267ffcc243aae6e3253920d8a57dd45

Download Submit
memory/1524-9-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1524-17-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4092-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4092-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing