a4b9fa3e0bb4f7b734f802414d497ce2c03f563c12f1c5f02d2686d15fa5c24a

General

Target

969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe
Size

385KB
MD5

969ae57360f6ad7faa8e47e0a671d144
SHA1

be666b41a05ae6ac93f0e065b23e6323fad1d5bf
SHA256

a4b9fa3e0bb4f7b734f802414d497ce2c03f563c12f1c5f02d2686d15fa5c24a
SHA512

9b5e6380c7ababb5c6780d1ded07c5f42fb49f8bd6525a5c5c2a11b91883756a1cb10ffaff870624b3a636afa64af03122674a7291ec08b841d1c9887d7b2948
SSDEEP

6144:q8FT5o7idgK9MOVOk06TEqIkOjD2JAyWLOSgbkffDXRyOFnNk4HMK:7T5o7idgK6OVZkjmDWLLffDhbR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1816	services.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\WINDOWS\\HELP\\services.exe"	services.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\pingar.bat	services.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\HELP\services.exe	969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\HELP\services.exe	969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3572	cmd.exe
5108	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5108	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1816	4716	969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe	93
PID 4716 wrote to memory of 1816	4716	969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe	93
PID 4716 wrote to memory of 1816	4716	969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe	93
PID 1816 wrote to memory of 3572	1816	services.exe	94
PID 1816 wrote to memory of 3572	1816	services.exe	94
PID 1816 wrote to memory of 3572	1816	services.exe	94
PID 3572 wrote to memory of 5108	3572	cmd.exe	96
PID 3572 wrote to memory of 5108	3572	cmd.exe	96
PID 3572 wrote to memory of 5108	3572	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\969ae57360f6ad7faa8e47e0a671d144_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\WINDOWS\HELP\services.exe
  C:\WINDOWS\HELP\services.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\SYSTEM32\pingar.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4120,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SysWOW64\pingar.bat

Filesize
60B

MD5
83474bafaa5530b7aa313cff6093c3c4

SHA1
a5d9e62ee94bd10210d1eae941f77c7346982fa9

SHA256
57d7ad2274359eca54df9f41729444389d4550415d020ac903aabeca0e9c1605

SHA512
f6e3d79f3b97c489b442d4700b793702bfcac4900a5992025fe2b5c246a0425c2f833476f55b5a3b30cefb2ad3d4203ee3acf913a85928da21d84131784e5970

Download Submit
C:\Windows\Help\services.exe

Filesize
385KB

MD5
969ae57360f6ad7faa8e47e0a671d144

SHA1
be666b41a05ae6ac93f0e065b23e6323fad1d5bf

SHA256
a4b9fa3e0bb4f7b734f802414d497ce2c03f563c12f1c5f02d2686d15fa5c24a

SHA512
9b5e6380c7ababb5c6780d1ded07c5f42fb49f8bd6525a5c5c2a11b91883756a1cb10ffaff870624b3a636afa64af03122674a7291ec08b841d1c9887d7b2948

Download Submit
memory/1816-5-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/1816-10-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4716-0-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/4716-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads