c548d468c4ba1b40e2eb640b34c6027193f19ec744b217b775a529e74c1ca439

General

Target
895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe
Size 14KB
Sample240811-hdwaxssgpg
SHA256 c548d468c4ba1b40e2eb640b34c6027193f19ec744b217b775a529e74c1ca439
MD5 895e126757faf8d9736168c1a7f8e2ed
SHA1 8eb6e0479f973488bf8eb76482b7dae7779990fa
SHA512 1800808aab5562c667d612abeab5f7e356ba8f7ecdfddb0e7d9569876f112b6a0a20ca53e7e871b8ebd100af76917cd2c345b3e1e991105a052a82f2f4b8aad1
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRP:hDXWipuE+K3/SSHgxj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	DEMA856.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	DEMFF7E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	DEM55DB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	DEMAC77.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	DEM2B5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe

Executes dropped EXE 6 IoCs

pid	Process
4788	DEMA856.exe
1464	DEMFF7E.exe
2532	DEM55DB.exe
3992	DEMAC77.exe
2920	DEM2B5.exe
1784	DEM58F4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM2B5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM58F4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMA856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMFF7E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM55DB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMAC77.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4788	2340	895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe	95
PID 2340 wrote to memory of 4788	2340	895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe	95
PID 2340 wrote to memory of 4788	2340	895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe	95
PID 4788 wrote to memory of 1464	4788	DEMA856.exe	100
PID 4788 wrote to memory of 1464	4788	DEMA856.exe	100
PID 4788 wrote to memory of 1464	4788	DEMA856.exe	100
PID 1464 wrote to memory of 2532	1464	DEMFF7E.exe	102
PID 1464 wrote to memory of 2532	1464	DEMFF7E.exe	102
PID 1464 wrote to memory of 2532	1464	DEMFF7E.exe	102
PID 2532 wrote to memory of 3992	2532	DEM55DB.exe	105
PID 2532 wrote to memory of 3992	2532	DEM55DB.exe	105
PID 2532 wrote to memory of 3992	2532	DEM55DB.exe	105
PID 3992 wrote to memory of 2920	3992	DEMAC77.exe	114
PID 3992 wrote to memory of 2920	3992	DEMAC77.exe	114
PID 3992 wrote to memory of 2920	3992	DEMAC77.exe	114
PID 2920 wrote to memory of 1784	2920	DEM2B5.exe	116
PID 2920 wrote to memory of 1784	2920	DEM2B5.exe	116
PID 2920 wrote to memory of 1784	2920	DEM2B5.exe	116

C:\Users\Admin\AppData\Local\Temp\895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\895e126757faf8d9736168c1a7f8e2ed_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\DEMA856.exe
  "C:\Users\Admin\AppData\Local\Temp\DEMA856.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\DEMFF7E.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMFF7E.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\DEM55DB.exe
      "C:\Users\Admin\AppData\Local\Temp\DEM55DB.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\DEMAC77.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMAC77.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\DEM2B5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM2B5.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\DEM58F4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM58F4.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM2B5.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM2B5.exe
Size 14KB
SHA256 00f913a7629e3cbe8bcae94d99a037d98dbc46f7be1c84e9265aae504e38dcdf
MD5 3df221563c90bd3f5ed5120dbbd13fe7
SHA1 db3fdcf9cdffd8437361a7244480c0f79978aa4b
SHA512 fa770d924258745f552596f3855dbb253a627e295aa83c8a7c7185e8afda3ecf19c3dda2accaf3f3155234ac6e798b562be4d6b01e477ef655ba5f50dfd01adf
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRl:hDXWipuE+K3/SSHgxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM55DB.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM55DB.exe
Size 14KB
SHA256 ecacdd354bf6f34f8343a58f67ada79d12743e92b7abb2bcba3fc276b6f92a5a
MD5 7481d6bc1c2d0635dd43a0e6c9bc061e
SHA1 9ff4f77dc98e4b95be0c1b8fdbeb5a5eee8a8b7b
SHA512 3fabb245d536f47379ac4259c586eba08cff560c5a8d2aefec0f9565cd81278e96c39fc439e1410a7726066e84e4d9d68048aed7880f87ef4f08d5d69e47beb8
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRF:hDXWipuE+K3/SSHgxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM58F4.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM58F4.exe
Size 14KB
SHA256 54416a603d1d4fbd37e7fef85384a20a9aa3ef70e70739610c0078c5ed1148e2
MD5 77efaf24ab4eb025438c31beeedf9706
SHA1 f170ff896bde7b94ed16ca80525e41446f717755
SHA512 9a167215b25d9320cd831de1754064b0715e768d273698de6de4563687992a3dcd89d04ba361770e200707286d239074b712cd2979875c0580f1642bf319b62a
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRh:hDXWipuE+K3/SSHgxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMA856.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMA856.exe
Size 14KB
SHA256 d0f88abdb95d540acc75c585928177bed7640243860d7ea807f37f01a5a8ed44
MD5 99180d4aaff111fdf90e538bc36d1a36
SHA1 e3f6e71f590a75c1fdba66d401e2efbb3a55bb0b
SHA512 cb3a708ef6c89ec82b228bea267e4f279b1b1fa2ffafb7aa92c85db38bb842ba2b5b129fb76cfb53ae9c1c0d24b4cd31757d051b2845fc3079267f5b4727f9d8
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRF:hDXWipuE+K3/SSHgxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMAC77.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMAC77.exe
Size 14KB
SHA256 4d4881930fd82dc979c72235b1177affa4cb772e5b46620767e19ff6e6e81e69
MD5 955a7dd922b41ed737b0ce9523d2de6a
SHA1 aca4a59e8d92eebdf1ac1b46673bd20496dc72df
SHA512 09af562cc6681ef4edc840583908659e7ebd662c694b0d36ab370cbecc4bd6fccca59b3ea623a666c5696a2b0ade5c47193d0104419d844d466d3916e2dd7380
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRg:hDXWipuE+K3/SSHgxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMFF7E.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMFF7E.exe
Size 14KB
SHA256 d2968b58ab0fe81a11cce0eb911b79d862f80a66e4fc12007ed202eac7fac2c0
MD5 416155a7fa638061b85b264c3a23193e
SHA1 c2ee309c23dd7cfaf0d1d7c571c144ad21bd4cb4
SHA512 e053f22ec9c7a2a711a4cdec664eef915b75b4042534435a8c57f1ce09c2c01efbc828df661a7cf71d87b05f2768b937bd51ea78a71e7b04b2efd3d19c3f7f64
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRh:hDXWipuE+K3/SSHgxt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads