c40964eec2de4b367c7227532c29a5e6c33d6d6f47a55f3b4bf1d905164259fd

General

Target

85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
Size

336KB
MD5

85454c4b77b458ccdaa9b096fc8a3c2d
SHA1

c98f06d2eae60823d0a767137e863218ce03f498
SHA256

c40964eec2de4b367c7227532c29a5e6c33d6d6f47a55f3b4bf1d905164259fd
SHA512

84ab6a1d21e39eb96204b7cfc8951c099cfb784eec40e46678659b280010385dac02c6feaa74c113c95c470e77efb0427564087ad3e983d4f76a38a7ec718c22
SSDEEP

6144:3IwfiYq0EL0/+dSYZq8qk/VjPP1JuT3OHt5qFZL:3dVEL8+dSQq8P/Vz1J23ONwX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5104	n9p1UCoTlad1HQS.exe

Executes dropped EXE 2 IoCs

pid	Process
2248	n9p1UCoTlad1HQS.exe
5104	n9p1UCoTlad1HQS.exe

Loads dropped DLL 4 IoCs

pid	Process
1816	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
1816	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
5104	n9p1UCoTlad1HQS.exe
5104	n9p1UCoTlad1HQS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7zmxT8EeeZo = "C:\\ProgramData\\yhZbOZEygTm1J\\n9p1UCoTlad1HQS.exe"	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 1816	552	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	87
PID 2248 set thread context of 5104	2248	n9p1UCoTlad1HQS.exe	89
PID 5104 set thread context of 4944	5104	n9p1UCoTlad1HQS.exe	90

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n9p1UCoTlad1HQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n9p1UCoTlad1HQS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eula.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1816	552	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	87
PID 552 wrote to memory of 1816	552	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	87
PID 552 wrote to memory of 1816	552	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	87
PID 552 wrote to memory of 1816	552	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	87
PID 552 wrote to memory of 1816	552	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	87
PID 1816 wrote to memory of 2248	1816	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	88
PID 1816 wrote to memory of 2248	1816	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	88
PID 1816 wrote to memory of 2248	1816	85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe	88
PID 2248 wrote to memory of 5104	2248	n9p1UCoTlad1HQS.exe	89
PID 2248 wrote to memory of 5104	2248	n9p1UCoTlad1HQS.exe	89
PID 2248 wrote to memory of 5104	2248	n9p1UCoTlad1HQS.exe	89
PID 2248 wrote to memory of 5104	2248	n9p1UCoTlad1HQS.exe	89
PID 2248 wrote to memory of 5104	2248	n9p1UCoTlad1HQS.exe	89
PID 5104 wrote to memory of 4944	5104	n9p1UCoTlad1HQS.exe	90
PID 5104 wrote to memory of 4944	5104	n9p1UCoTlad1HQS.exe	90
PID 5104 wrote to memory of 4944	5104	n9p1UCoTlad1HQS.exe	90
PID 5104 wrote to memory of 4944	5104	n9p1UCoTlad1HQS.exe	90
PID 5104 wrote to memory of 4944	5104	n9p1UCoTlad1HQS.exe	90

C:\Users\Admin\AppData\Local\Temp\85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\85454c4b77b458ccdaa9b096fc8a3c2d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\ProgramData\yhZbOZEygTm1J\n9p1UCoTlad1HQS.exe
    "C:\ProgramData\yhZbOZEygTm1J\n9p1UCoTlad1HQS.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\ProgramData\yhZbOZEygTm1J\n9p1UCoTlad1HQS.exe
      "C:\ProgramData\yhZbOZEygTm1J\n9p1UCoTlad1HQS.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe" /i:5104
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\yhZbOZEygTm1J\RCX6793.tmp

Filesize
336KB

MD5
440da9a351bd99eae8a9af9b10d7f8c4

SHA1
9a66c2e4750ed4ad6ee309a3dde73e52660b8bda

SHA256
4fee7a818fdaf45da96faf41e8f79fd5850341f721ca828e7cbe9b3e6edd1a17

SHA512
0e5b0d04cba22a555eeb1063c28cc4be11a40f93025f36d36779b1d69fb1d8cad4a169aa457a219c6b67c2df1320854110b861fe5119fc79d90269e142e70f13

Download Submit
C:\ProgramData\yhZbOZEygTm1J\n9p1UCoTlad1HQS.exe

Filesize
336KB

MD5
85454c4b77b458ccdaa9b096fc8a3c2d

SHA1
c98f06d2eae60823d0a767137e863218ce03f498

SHA256
c40964eec2de4b367c7227532c29a5e6c33d6d6f47a55f3b4bf1d905164259fd

SHA512
84ab6a1d21e39eb96204b7cfc8951c099cfb784eec40e46678659b280010385dac02c6feaa74c113c95c470e77efb0427564087ad3e983d4f76a38a7ec718c22

Download Submit
memory/552-5-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/552-3-0x00000000756B0000-0x00000000756B1000-memory.dmp

Filesize
4KB

Download
memory/1816-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1816-4-0x0000000075690000-0x0000000075780000-memory.dmp

Filesize
960KB

Download
memory/1816-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1816-2-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1816-17-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1816-21-0x0000000075690000-0x0000000075780000-memory.dmp

Filesize
960KB

Download
memory/2248-24-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4944-38-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/5104-27-0x0000000075690000-0x0000000075780000-memory.dmp

Filesize
960KB

Download
memory/5104-39-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/5104-41-0x0000000075690000-0x0000000075780000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads