3d8f0e09e5941bf8d91f8e61ab6e8f97fa423c04c1694a0ddcc83957e9abf059

General

Target

959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe
Size

52KB
MD5

959a7b3903f0dba2b56aed3ac8575e94
SHA1

d5c3a08cfc2b0a74cbed663872a972aafe3c2f22
SHA256

3d8f0e09e5941bf8d91f8e61ab6e8f97fa423c04c1694a0ddcc83957e9abf059
SHA512

5d1b0863d5cf9f6bf833145c14671b7e2b74a42fb25159f44a87e046c50d8c46ce55ecbf87a3cea889e774c01535d86a6c0a034a3f2a11f478ecd8413d52adb6
SSDEEP

1536:Ghp5yQvXN835moaTt7m0OIFh+1Y9y1xwGw:Gh3LvXE5moaQ0r1k

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2464	wminit.exe

Executes dropped EXE 1 IoCs

pid	Process
2464	wminit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wminit = "C:\\Program Files (x86)\\Common Files\\System\\wminit.exe"	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\wminit.dat	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\wminit.exe	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\wminit.exe	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4244	4924	WerFault.exe	83
4992	2464	WerFault.exe	85
908	2464	WerFault.exe	85
1408	2464	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wminit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2464	4924	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe	85
PID 4924 wrote to memory of 2464	4924	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe	85
PID 4924 wrote to memory of 2464	4924	959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Common Files\System\wminit.exe
  "C:\Program Files (x86)\Common Files\System\wminit.exe" "C:\Users\Admin\AppData\Local\Temp\959a7b3903f0dba2b56aed3ac8575e94_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 632
    3⤵
    - Program crash
    PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 628
    3⤵
    - Program crash
    PID:908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 652
    3⤵
    - Program crash
    PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 316
  2⤵
  - Program crash
  PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4924 -ip 4924
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2464 -ip 2464
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2464 -ip 2464
1⤵
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2464 -ip 2464
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\System\wminit.dat

Filesize
8B

MD5
ba58794b65be3b43a29a665d4da2d84e

SHA1
73a021b9524d9e5b6361b23a960660f25d9dddd9

SHA256
b245e67041f8c99df4ccf48183859128c14c3d62013b43b73c47d566c4a72f6b

SHA512
a8719bfe73d3890a4efa27da89b3d44a332741d41128e5df7e33d8e46ec194fdb38e4d5e96f8419d630417ab3e866fc327c67ad86d94a1d2b03917ad2672a129

Download Submit
C:\Program Files (x86)\Common Files\System\wminit.exe

Filesize
52KB

MD5
959a7b3903f0dba2b56aed3ac8575e94

SHA1
d5c3a08cfc2b0a74cbed663872a972aafe3c2f22

SHA256
3d8f0e09e5941bf8d91f8e61ab6e8f97fa423c04c1694a0ddcc83957e9abf059

SHA512
5d1b0863d5cf9f6bf833145c14671b7e2b74a42fb25159f44a87e046c50d8c46ce55ecbf87a3cea889e774c01535d86a6c0a034a3f2a11f478ecd8413d52adb6

Download Submit
memory/2464-16-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-18-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-28-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-26-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-11-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-24-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-12-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-22-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/2464-20-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/4924-1-0x0000000000D50000-0x0000000000D56000-memory.dmp

Filesize
24KB

Download
memory/4924-0-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/4924-15-0x0000000000ED2000-0x0000000000F95000-memory.dmp

Filesize
780KB

Download
memory/4924-14-0x0000000000D50000-0x0000000000D56000-memory.dmp

Filesize
24KB

Download
memory/4924-13-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download
memory/4924-4-0x0000000000ED2000-0x0000000000F95000-memory.dmp

Filesize
780KB

Download
memory/4924-2-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4924-5-0x0000000000ED0000-0x0000000000F97000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads