4224809d547e150e9399ea2ba89345c0bfe5976d246af9b1b49f1c53be006b37

General

Target

8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
Size

125KB
MD5

8d65493faee8cb53c94a0bbe20e13f65
SHA1

241be638d692b9f5631ef191fd433019fb4ea639
SHA256

4224809d547e150e9399ea2ba89345c0bfe5976d246af9b1b49f1c53be006b37
SHA512

6fcd845e82681bce7686fd551c30ac1a59fdadf93bee5bd0e5fbbe5cefca5930f0cd93f427dbd6be3e03b72c112da9fdb1d16a35ad84c66927f9890cf1633d18
SSDEEP

1536:XoOqW17BglIjI0zZNDTC8o3ftaa89Er37AAPNXs3qtRPYJxiJ1QS:x1ZTBo3ICrrdW3qtRPJe

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\win32x.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\driverstore\filerepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\ufxchipidea.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\userinit.exe	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\compositebus.inf_amd64_7500cffa210c6946\compositebus.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\swenum.inf_amd64_16a14542b63c02af\swenum.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\uefi.inf_amd64_c1628ffa62c8e54c\uefi.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\umbus.inf_amd64_b78a9c5b6fd62c27\umbus.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\driverstore\filerepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 3576	3316	8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3576
- C:\Users\Admin\AppData\Local\Temp\8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8d65493faee8cb53c94a0bbe20e13f65_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3316-0-0x00000000021B0000-0x00000000021B3000-memory.dmp

Filesize
12KB

Download
memory/3316-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3316-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing