a05034c0ebc40ce9f7ec36f8461911bb23d9255179154e5b6a932837923e71be

General

Target

732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe
Size

3.5MB
MD5

732303dee131a341a9a9a1383dd7ddf0
SHA1

f230af5b99b9bc93ad861d330caeef6f16c021a9
SHA256

a05034c0ebc40ce9f7ec36f8461911bb23d9255179154e5b6a932837923e71be
SHA512

120b911ef19b6b5621757b705eb45101763423dc7610aa694a6000b1a52d21c0db885a6ddd69bf9f7a64614ce522050e7a2076145c47794a50ac3a70a9f350f6
SSDEEP

49152:HelnQLaNEgWvkdr9sBGuPnIWRy3PseYtyWygfoGJo0grk8iggWvkdr9sBGuPnIWp:HENe03F2bdod0grWK03F2b

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3520	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3520	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	pastebin.com
19	pastebin.com

Program crash 16 IoCs

pid	pid_target	Process	procid_target
1652	3400	WerFault.exe	83
1384	3520	WerFault.exe	91
640	3520	WerFault.exe	91
5048	3520	WerFault.exe	91
3848	3520	WerFault.exe	91
452	3520	WerFault.exe	91
3236	3520	WerFault.exe	91
4160	3520	WerFault.exe	91
5084	3520	WerFault.exe	91
5068	3520	WerFault.exe	91
324	3520	WerFault.exe	91
5016	3520	WerFault.exe	91
5100	3520	WerFault.exe	91
3840	3520	WerFault.exe	91
2796	3520	WerFault.exe	91
4160	3520	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe
3520	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3400	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3520	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3520	3400	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe	91
PID 3400 wrote to memory of 3520	3400	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe	91
PID 3400 wrote to memory of 3520	3400	732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 344
  2⤵
  - Program crash
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 344
    3⤵
    - Program crash
    PID:1384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 616
    3⤵
    - Program crash
    PID:640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 664
    3⤵
    - Program crash
    PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 672
    3⤵
    - Program crash
    PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 720
    3⤵
    - Program crash
    PID:452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1040
    3⤵
    - Program crash
    PID:3236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1396
    3⤵
    - Program crash
    PID:4160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1456
    3⤵
    - Program crash
    PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1492
    3⤵
    - Program crash
    PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1396
    3⤵
    - Program crash
    PID:324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1636
    3⤵
    - Program crash
    PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1496
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1484
    3⤵
    - Program crash
    PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1536
    3⤵
    - Program crash
    PID:2796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 632
    3⤵
    - Program crash
    PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3400 -ip 3400
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3520 -ip 3520
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3520 -ip 3520
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3520 -ip 3520
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3520 -ip 3520
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3520 -ip 3520
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3520 -ip 3520
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3520 -ip 3520
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3520 -ip 3520
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3520 -ip 3520
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3520 -ip 3520
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3520 -ip 3520
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3520 -ip 3520
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3520 -ip 3520
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3520 -ip 3520
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3520 -ip 3520
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\732303dee131a341a9a9a1383dd7ddf0_JaffaCakes118.exe

Filesize
3.5MB

MD5
4117d14694b385a7c716f4bdd56c7706

SHA1
63a39f7e55a423c091a145f593cb1d23499ab540

SHA256
7c584e9213a495f13d275751d2ca67c53e2a0089d21ce8785b96668e1be71adb

SHA512
728cc4dae8f2825a289928fbdd35aca76bc921d0093c71633cabf0d73017d628e5bbc622f68eff36241ff26ff4ce3ac66d024663bd52d71a975bd16f34b6de98

Download Submit
memory/3400-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3400-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3520-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3520-15-0x0000000005000000-0x00000000050E5000-memory.dmp

Filesize
916KB

Download
memory/3520-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3520-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3520-28-0x000000000B9B0000-0x000000000BA53000-memory.dmp

Filesize
652KB

Download

Analysis

Sharing