4d0bed8556e3bb72d1d58eabb0d913635e0dd834df9e39d5d76e211da717e3ec

General

Target

5ec947de80e1f54ce7f0e36e97185710_JaffaCakes118.exe
Size

2.4MB
MD5

5ec947de80e1f54ce7f0e36e97185710
SHA1

489b3a403e552e91d5a19b90db79e2a0dbc5c2b3
SHA256

4d0bed8556e3bb72d1d58eabb0d913635e0dd834df9e39d5d76e211da717e3ec
SHA512

58ad6b550261a0aff30a3ce3c8f30d5c14843d7c278e1dae58fdccd23b33f0ab49972763580ee7f064d704a8034c009adaa42d99e06ce0ade7b14c995697ba79
SSDEEP

49152:BRQ4vLFY5AZCgDR89fMByapkN4gLTsnBzodIPaQN0RsnQs96mTCd8dNDS0b:02Y5AZpbkW2T+uIiG0gN9bCd+x5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	StpA8F2_TMP.EXE

Executes dropped EXE 1 IoCs

pid	Process
3360	StpA8F2_TMP.EXE

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	StpA8F2_TMP.EXE

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3440	msiexec.exe
Token: SeSecurityPrivilege	64	msiexec.exe
Token: SeCreateTokenPrivilege	3440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3440	msiexec.exe
Token: SeLockMemoryPrivilege	3440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3440	msiexec.exe
Token: SeMachineAccountPrivilege	3440	msiexec.exe
Token: SeTcbPrivilege	3440	msiexec.exe
Token: SeSecurityPrivilege	3440	msiexec.exe
Token: SeTakeOwnershipPrivilege	3440	msiexec.exe
Token: SeLoadDriverPrivilege	3440	msiexec.exe
Token: SeSystemProfilePrivilege	3440	msiexec.exe
Token: SeSystemtimePrivilege	3440	msiexec.exe
Token: SeProfSingleProcessPrivilege	3440	msiexec.exe
Token: SeIncBasePriorityPrivilege	3440	msiexec.exe
Token: SeCreatePagefilePrivilege	3440	msiexec.exe
Token: SeCreatePermanentPrivilege	3440	msiexec.exe
Token: SeBackupPrivilege	3440	msiexec.exe
Token: SeRestorePrivilege	3440	msiexec.exe
Token: SeShutdownPrivilege	3440	msiexec.exe
Token: SeDebugPrivilege	3440	msiexec.exe
Token: SeAuditPrivilege	3440	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3440	msiexec.exe
Token: SeChangeNotifyPrivilege	3440	msiexec.exe
Token: SeRemoteShutdownPrivilege	3440	msiexec.exe
Token: SeUndockPrivilege	3440	msiexec.exe
Token: SeSyncAgentPrivilege	3440	msiexec.exe
Token: SeEnableDelegationPrivilege	3440	msiexec.exe
Token: SeManageVolumePrivilege	3440	msiexec.exe
Token: SeImpersonatePrivilege	3440	msiexec.exe
Token: SeCreateGlobalPrivilege	3440	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3440	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3360	2972	5ec947de80e1f54ce7f0e36e97185710_JaffaCakes118.exe	84
PID 2972 wrote to memory of 3360	2972	5ec947de80e1f54ce7f0e36e97185710_JaffaCakes118.exe	84
PID 2972 wrote to memory of 3360	2972	5ec947de80e1f54ce7f0e36e97185710_JaffaCakes118.exe	84
PID 3360 wrote to memory of 3440	3360	StpA8F2_TMP.EXE	87
PID 3360 wrote to memory of 3440	3360	StpA8F2_TMP.EXE	87
PID 3360 wrote to memory of 3440	3360	StpA8F2_TMP.EXE	87

C:\Users\Admin\AppData\Local\Temp\5ec947de80e1f54ce7f0e36e97185710_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ec947de80e1f54ce7f0e36e97185710_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\StpA8F2_TMP.EXE
  "C:\Users\Admin\AppData\Local\Temp\StpA8F2_TMP.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\spyzookasetup.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\StpA8F2_TMP.EXE

Filesize
2.3MB

MD5
f3b40eafb791701999d53c1bdb0af884

SHA1
2ed4c663798281506197eb0ae9a7a149a0a1cdff

SHA256
94dd864e69046179880296e61c9952d94a60f2b242c2860acfe8e3d47c66f083

SHA512
e543c6e4a50e7b766734566cba68c4547222fea0038dad1778e99661713ccb1de4b0b158af338cc0bd122006afa53e1543f3525af5e77a1c0bc66c5d98ede78a

Download Submit
C:\Users\Admin\AppData\Local\Temp\spyzookasetup.msi

Filesize
178KB

MD5
79f84c6efc767bd543d8baf37cbbb530

SHA1
85c783b7edf15d7b03acf84dd45b6a8f580993ec

SHA256
7711c6698e4761d7b1acc9de95095b4a02a388a7b5f08f2a61203c877938cae7

SHA512
12016db4baf41bdb8b76d71aac6e9996a5f371c5c47911e11a78812922c6d08087d504303961bff84ca3e0abc1bf5be107329f81b73303589a1f6be01059d556

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads