e97d499c316f55c0ad78e979abdfc7e22ef4a57373da2589afce5420f5b0a536

General

Target

8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe
Size

56KB
MD5

8603e88e29ffa780d9308e122f480d3c
SHA1

064ce4fa9e76d736e34274d1b5fc723094a81b45
SHA256

e97d499c316f55c0ad78e979abdfc7e22ef4a57373da2589afce5420f5b0a536
SHA512

fe31258bde36f9fefafbf32c5d1e309f82de4b1a66b833842d1445d3630d940c403215775b95a56c095af6fa943abab74d6ac095890a5b8a1a508e8095959309
SSDEEP

768:bW7CC1tOSaMTDT/RmyHZ+MTDT/RmyHZ+MTDT/RmyHZ4:bGhvzfBRfBRfBm

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe

Executes dropped EXE 6 IoCs

pid	Process
4712	p4r4d0xTemp1.exe
2424	p4r4d0xTemp2.exe
2988	p4r4d0xTemp3.exe
3268	p4r4d0xTemp1.exe
2000	p4r4d0xTemp3.exe
1556	p4r4d0xTemp2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1744	2000	WerFault.exe	90
4572	3268	WerFault.exe	89
2860	1556	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p4r4d0xTemp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p4r4d0xTemp1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p4r4d0xTemp3.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4712	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	86
PID 2820 wrote to memory of 4712	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	86
PID 2820 wrote to memory of 4712	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	86
PID 2820 wrote to memory of 2424	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	87
PID 2820 wrote to memory of 2424	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	87
PID 2820 wrote to memory of 2424	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	87
PID 2820 wrote to memory of 2988	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	88
PID 2820 wrote to memory of 2988	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	88
PID 2820 wrote to memory of 2988	2820	8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe	88
PID 4712 wrote to memory of 3268	4712	p4r4d0xTemp1.exe	89
PID 4712 wrote to memory of 3268	4712	p4r4d0xTemp1.exe	89
PID 4712 wrote to memory of 3268	4712	p4r4d0xTemp1.exe	89
PID 2988 wrote to memory of 2000	2988	p4r4d0xTemp3.exe	90
PID 2988 wrote to memory of 2000	2988	p4r4d0xTemp3.exe	90
PID 2988 wrote to memory of 2000	2988	p4r4d0xTemp3.exe	90
PID 2424 wrote to memory of 1556	2424	p4r4d0xTemp2.exe	91
PID 2424 wrote to memory of 1556	2424	p4r4d0xTemp2.exe	91
PID 2424 wrote to memory of 1556	2424	p4r4d0xTemp2.exe	91

C:\Users\Admin\AppData\Local\Temp\8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8603e88e29ffa780d9308e122f480d3c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp1.exe
  "C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp1.exe
    StubPath
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 460
      4⤵
      Program crash
      PID:4572
- C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp2.exe
  "C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp2.exe
    StubPath
    3⤵
    - Executes dropped EXE
    PID:1556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 468
      4⤵
      Program crash
      PID:2860
- C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp3.exe
  "C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp3.exe
    StubPath
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 460
      4⤵
      Program crash
      PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3268 -ip 3268
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2000 -ip 2000
1⤵
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1556 -ip 1556
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\p4r4d0xTemp1.exe

Filesize
13KB

MD5
ecc25865997f051bedcded85d2b41b4f

SHA1
929f231b63298f6715b7866757d550a7f7dc618c

SHA256
a45c9bd1d083df2286e5f94e81663d402cce932b79c1a61b0c957f19b40cc2fb

SHA512
511559a6b5bb616d51ab373e1ad3bf7e9a36449aa65a5c4f4a17d78ba513775d67b8d0582eef9f2497b682c1614da1f9b15ac50132dbe4d1c59865cc3cf634e9

Download Submit
memory/2820-0-0x00007FFE65465000-0x00007FFE65466000-memory.dmp

Filesize
4KB

Download
memory/2820-1-0x000000001BEB0000-0x000000001BF56000-memory.dmp

Filesize
664KB

Download
memory/2820-2-0x00007FFE651B0000-0x00007FFE65B51000-memory.dmp

Filesize
9.6MB

Download
memory/2820-3-0x000000001C430000-0x000000001C8FE000-memory.dmp

Filesize
4.8MB

Download
memory/2820-4-0x000000001C9A0000-0x000000001CA3C000-memory.dmp

Filesize
624KB

Download
memory/2820-5-0x00007FFE651B0000-0x00007FFE65B51000-memory.dmp

Filesize
9.6MB

Download
memory/2820-6-0x0000000001710000-0x0000000001718000-memory.dmp

Filesize
32KB

Download
memory/2820-7-0x000000001CAD0000-0x000000001CB1C000-memory.dmp

Filesize
304KB

Download
memory/2820-33-0x00007FFE651B0000-0x00007FFE65B51000-memory.dmp

Filesize
9.6MB

Download
memory/2820-37-0x00007FFE651B0000-0x00007FFE65B51000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing