a81acbdd97289efb19ab3a90c29e49352753f02db07a3c395bf3176586760e50

General

Target

60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe
Size

388KB
MD5

60dfb5adfc7be9dd987da51a144a5d17
SHA1

87d51833a1dacbc569039a733fe8a17df1cfdf41
SHA256

a81acbdd97289efb19ab3a90c29e49352753f02db07a3c395bf3176586760e50
SHA512

923e3fe779d0689936f36ea582e8463ba1dc21ad98e49d4adcdc8ccd18b6e1aace2277386acd26e6839aae197a53b0a71687d4ff4312b050cf165307ee96631a
SSDEEP

3072:WqBl2VSB3hSE4b5kivlyZXhYU4wAZLYA42pGx+7Tgc67OMGD35Kh:n1BRy9vehGwUL74w6aMcm

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
968	zlfgik.exe

Loads dropped DLL 1 IoCs

pid	Process
968	zlfgik.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
940	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4788	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
968	zlfgik.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
968	zlfgik.exe
968	zlfgik.exe
968	zlfgik.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
968	zlfgik.exe
968	zlfgik.exe
968	zlfgik.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4068	2996	60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe	85
PID 2996 wrote to memory of 4068	2996	60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe	85
PID 2996 wrote to memory of 4068	2996	60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe	85
PID 4068 wrote to memory of 940	4068	cmd.exe	88
PID 4068 wrote to memory of 940	4068	cmd.exe	88
PID 4068 wrote to memory of 940	4068	cmd.exe	88
PID 4068 wrote to memory of 4788	4068	cmd.exe	91
PID 4068 wrote to memory of 4788	4068	cmd.exe	91
PID 4068 wrote to memory of 4788	4068	cmd.exe	91
PID 4068 wrote to memory of 968	4068	cmd.exe	94
PID 4068 wrote to memory of 968	4068	cmd.exe	94
PID 4068 wrote to memory of 968	4068	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2996 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\60dfb5adfc7be9dd987da51a144a5d17_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\zlfgik.exe -f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 2996
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:4788
- - C:\Users\Admin\AppData\Local\zlfgik.exe
    C:\Users\Admin\AppData\Local\zlfgik.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\zlfgik.exe

Filesize
388KB

MD5
60dfb5adfc7be9dd987da51a144a5d17

SHA1
87d51833a1dacbc569039a733fe8a17df1cfdf41

SHA256
a81acbdd97289efb19ab3a90c29e49352753f02db07a3c395bf3176586760e50

SHA512
923e3fe779d0689936f36ea582e8463ba1dc21ad98e49d4adcdc8ccd18b6e1aace2277386acd26e6839aae197a53b0a71687d4ff4312b050cf165307ee96631a

Download Submit
memory/968-26-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-34-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-40-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-38-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-36-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-19-0x0000000000E30000-0x0000000000F31000-memory.dmp

Filesize
1.0MB

Download
memory/968-31-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-17-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-16-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-14-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-13-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-12-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-29-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-21-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-18-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-23-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-24-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/968-27-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/2996-0-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/2996-2-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2996-1-0x0000000000560000-0x0000000000585000-memory.dmp

Filesize
148KB

Download
memory/2996-7-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/2996-8-0x0000000000560000-0x0000000000585000-memory.dmp

Filesize
148KB

Download
memory/2996-4-0x0000000001000000-0x0000000001101000-memory.dmp

Filesize
1.0MB

Download
memory/2996-3-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing