572efcf858a95bc19f5aeae51ac834c007e92902ff8b96d9dac588162374e72e

General

Target

84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
Size

409KB
MD5

84a153feb0c613fc291fd7193182ca1f
SHA1

1e0a75ef9167d89b7bcbf1cd8461b105c87471d5
SHA256

572efcf858a95bc19f5aeae51ac834c007e92902ff8b96d9dac588162374e72e
SHA512

0cc7d2ec26832be7dfb55372778404699e7a3a3188e4a211b66ec70c01fdc7c3b8ddbf468b4c9c01e6015ea639e62adb78197b1cdc77f4f607cdcbaa6ee7fc34
SSDEEP

6144:LUA/ePHC1kZx0rtc0K0F2idZecnl20lHRxp3gnR7LN9qcUZ3uRBmbpOo9:o961IPzUF3Z4mxxwVn1Y3isEo9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2880	uninst.exe

Loads dropped DLL 2 IoCs

pid	Process
2880	uninst.exe
2352	svchost.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uninst.dll	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\uninst.dll	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uninst.dat	uninst.exe
File created	C:\Windows\SysWOW64\uninst.exe	uninst.exe
File opened for modification	C:\Windows\SysWOW64\uninst.exe	uninst.exe
File opened for modification	C:\Windows\SysWOW64\uninst.dll	uninst.exe
File created	C:\Windows\SysWOW64\uninst.exe	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\uninst.exe	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2752	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
Token: SeDebugPrivilege	2880	uninst.exe
Token: SeDebugPrivilege	2352	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2988	2752	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2988	2752	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2988	2752	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2988	2752	84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe	31
PID 2880 wrote to memory of 2352	2880	uninst.exe	32
PID 2880 wrote to memory of 2352	2880	uninst.exe	32
PID 2880 wrote to memory of 2352	2880	uninst.exe	32
PID 2880 wrote to memory of 2352	2880	uninst.exe	32
PID 2880 wrote to memory of 2352	2880	uninst.exe	32
PID 2880 wrote to memory of 2352	2880	uninst.exe	32

C:\Users\Admin\AppData\Local\Temp\84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84a153feb0c613fc291fd7193182ca1f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\84A153~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2988

C:\Windows\SysWOW64\uninst.exe
C:\Windows\SysWOW64\uninst.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1235.dat

Filesize
336B

MD5
3ed25b82a665186b5f1e4e386ee088c8

SHA1
a3b8e5f6aa3d86e82febc13adf7ce82588e4cfda

SHA256
cd9afce076e3de0bc5d37e96bd9da6c7520d110df4e0faaa7634a4b59740c168

SHA512
911ee4092e46c571703fae9aa1f3d00c9f7a9f220493c240b23323a0cc9971dbbea8ea1a62a2ac2ff3c99eeffdc83f4ea774f8b71196225f70829b76d06e51e9

Download Submit
C:\Windows\SysWOW64\uninst.dll

Filesize
136KB

MD5
1e404228b78bf6e7d10e45c3230bba13

SHA1
352b70be3c4dedb67f7d86c52e395621b1180d6c

SHA256
29891994b55429140ebe4e6e7305a918212e32d35275769d263eb2d10a0b44b2

SHA512
c2ea9cfd4bdcb52f588ad8896a2b207209311f1840a5593e17a3028b8c05919e284e972661d109c3cbd71f626afd4fafa73827a7afa716b619e2c9d20b535ad0

Download Submit
C:\Windows\SysWOW64\uninst.exe

Filesize
409KB

MD5
84a153feb0c613fc291fd7193182ca1f

SHA1
1e0a75ef9167d89b7bcbf1cd8461b105c87471d5

SHA256
572efcf858a95bc19f5aeae51ac834c007e92902ff8b96d9dac588162374e72e

SHA512
0cc7d2ec26832be7dfb55372778404699e7a3a3188e4a211b66ec70c01fdc7c3b8ddbf468b4c9c01e6015ea639e62adb78197b1cdc77f4f607cdcbaa6ee7fc34

Download Submit
memory/2352-59-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2352-56-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2752-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2752-1-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2752-2-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2752-18-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2752-38-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2880-39-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2880-63-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing