e85c8b5da59de4dca4e3ba59437c0685b61ed3dba87f5db2deb618a6793cd1c8

General

Target

8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe
Size

153KB
MD5

8cfbfe8e3c17f190a1f6a05751b73ada
SHA1

573204ceb3634b926efb2d86a061848d9074f0f4
SHA256

e85c8b5da59de4dca4e3ba59437c0685b61ed3dba87f5db2deb618a6793cd1c8
SHA512

e4e2dae353fb26c1ec215f94ba6e4707f96519907a6d912edf034806bc2bef247247c4462bedead919fb9c06474878d9ec0eefe357d6722cc13f7957ef87a2f5
SSDEEP

3072:RS/4DDEifl+aMvJ2OpgDP0PHzFDt8WvCxmK4nG8SuNIZ91p3/Eq8:o6Df8S0/zFx7CaGTD3/Ev

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1764	taskkill.exe
2152	taskkill.exe
2280	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2280	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	30
PID 3020 wrote to memory of 2280	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	30
PID 3020 wrote to memory of 2280	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	30
PID 3020 wrote to memory of 2280	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	30
PID 3020 wrote to memory of 2092	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2092	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2092	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2092	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2360	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	33
PID 3020 wrote to memory of 2360	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	33
PID 3020 wrote to memory of 2360	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	33
PID 3020 wrote to memory of 2360	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	33
PID 3020 wrote to memory of 1764	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	39
PID 3020 wrote to memory of 1764	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	39
PID 3020 wrote to memory of 1764	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	39
PID 3020 wrote to memory of 1764	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	39
PID 3020 wrote to memory of 2152	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	40
PID 3020 wrote to memory of 2152	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	40
PID 3020 wrote to memory of 2152	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	40
PID 3020 wrote to memory of 2152	3020	8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe	40

C:\Users\Admin\AppData\Local\Temp\8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 99Lover.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del "C:\Users\Admin\Cookies" /Q, vbHide
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 99Lover.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im 99Lover.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3020-3-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/3020-4-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3020-5-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing