6763f4c69ce0cc49786e32aaabd05299c37d34fed22488918a51215e150aaf5c

General

Target

030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe
Size

8.3MB
MD5

030f864c38a1ac3dc2e3e8a56287beb7
SHA1

0f31b2bcbb9a1a28ad3cc960d832f0a8e964a240
SHA256

6763f4c69ce0cc49786e32aaabd05299c37d34fed22488918a51215e150aaf5c
SHA512

8b2c10e9e81c801acf4aefebbb8e809c1596b572b06ab2714f33d2f02dea7e1c6ca261460c825cfdafc9b9b70772ced596d49b5f83f84f12e667aee0d39898b0
SSDEEP

196608:Q3E1TMQoyOeLhhJ9hjp/3jg8WPI2EUY8sK+dx:9zLhz7jZgbJp9+dx

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp

Loads dropped DLL 2 IoCs

pid	Process
2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe
2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2348	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2556	2508	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2348	2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp	32
PID 2556 wrote to memory of 2348	2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp	32
PID 2556 wrote to memory of 2348	2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp	32
PID 2556 wrote to memory of 2348	2556	030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp	32

C:\Users\Admin\AppData\Local\Temp\030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\is-VTEPG.tmp\030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VTEPG.tmp\030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp" /SL5="$70150,8156627,575488,C:\Users\Admin\AppData\Local\Temp\030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im AdvancedIdentityProtector.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-VTEPG.tmp\030f864c38a1ac3dc2e3e8a56287beb7_JaffaCakes118.tmp

Filesize
1.6MB

MD5
61bfa19fa5e6868f8fcb044bc5366132

SHA1
70ae78380c196a86d60aaf9303fef792a956b198

SHA256
02e1a393f5bda49862986f6ee05fe5843cd0ae457984f961feb9d943f000418a

SHA512
e2925a8c1df37b71c49f72d9d3135f7c2c4fb6410661ba63db52fb5e8f6ddebda13db93837681e85f05af57ce299d56113492324301a4c57a09022d9ac5e2582

Download Submit
\Users\Admin\AppData\Local\Temp\is-J4335.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
memory/2508-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2508-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2508-14-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2556-9-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2556-15-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing