cf9821fd84d57ee51c4b5faabc170d34b121f37dcd2b0b41737e4209b364c79d

General

Target

68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe
Size

215KB
MD5

68b824adf3d751b86a60303946afbd07
SHA1

1c434c641cb46939c084e2f6cb29fdb6869c5c74
SHA256

cf9821fd84d57ee51c4b5faabc170d34b121f37dcd2b0b41737e4209b364c79d
SHA512

3c2323d5f1a08ede3763ebac7030e00c599b98d9ebc32aafa086708f5f2fee54bbcedd9dbd94229bdbab0a8e8a08a3cec51e11aabb531731fb121196c1cc3e15
SSDEEP

3072:ABmTdhovoxMp/wdri3D7qT04DaGYK+yKEnJpgJnNk7HtG/3m/R7S1cUXsEo1IvB3:arAxA3gd5JpeDvfx/qfz

Score

6^/10

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\smrsc = "C:\\WINDOWS\\system\\smrsc.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smrsc = "C:\\WINDOWS\\system\\smrsc.exe"	reg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\smrsc.exe	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe
File created	C:\Windows\system\smrsc.exe	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2696	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2696	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2696	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2696	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2092	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2092	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2092	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2092	2172	68b824adf3d751b86a60303946afbd07_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2944	2092	cmd.exe	34
PID 2092 wrote to memory of 2944	2092	cmd.exe	34
PID 2092 wrote to memory of 2944	2092	cmd.exe	34
PID 2092 wrote to memory of 2944	2092	cmd.exe	34
PID 2696 wrote to memory of 1232	2696	cmd.exe	35
PID 2696 wrote to memory of 1232	2696	cmd.exe	35
PID 2696 wrote to memory of 1232	2696	cmd.exe	35
PID 2696 wrote to memory of 1232	2696	cmd.exe	35