1d1250b78aafcd3f5c0e9784c164e5deb8a67e68604dc502803f7656d4b68f00

General

Target

a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
Size

328KB
MD5

a067bacad57182cbbc45f2fc7263790c
SHA1

f648add61310f6d1c7fd2ca7a0b1e7304ea82891
SHA256

1d1250b78aafcd3f5c0e9784c164e5deb8a67e68604dc502803f7656d4b68f00
SHA512

8732b2dc80df148306bc82d6b03b3cd784b9ad4e7c7a310d371745e45a637f9904f5897de61df0a92387d7ca8ce99cd13e057a650919158f5099943e407629be
SSDEEP

6144:ze34tInplRit+5ksQXzGWNk/r3bNb8vYsXaV4/CqfYIlQJNtG:rIplRmKit6jLZsKu/qImi

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2740	rkverify.exe

Loads dropped DLL 6 IoCs

pid	Process
3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
2740	rkverify.exe
3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rkverify.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2740	rkverify.exe
2740	rkverify.exe
2740	rkverify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	rkverify.exe
2740	rkverify.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2740	3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2740	3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2740	3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe	30
PID 3056 wrote to memory of 2740	3056	a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a067bacad57182cbbc45f2fc7263790c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\rkverify.exe
  C:\Users\Admin\AppData\Local\Temp\rkverify.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2740

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\CSM8018.tmp

Filesize
200KB

MD5
c760be13a9328aaa3e75075b86520546

SHA1
e23459a7ce698ef9421147964d33c49323f5bc28

SHA256
1f63e66d08225a0f775c13cbb052d7cba0f19fb760767973e8bf7eb4152a18fd

SHA512
54ad187e54416a9d8cbf385b4f37723c513a960bb0c73f685c8c454eafc2b0f8e75adb060f65cf4d166236a756ddf735a78a6dba22096a2a59e26e6fe58265b7

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8400.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8400.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe

Filesize
368KB

MD5
7ce09413d7e39a8d984d29b032499a68

SHA1
23b404b6d460c57572e277883527a7af053dd7d2

SHA256
7d9967027f313bdc045565d408fd278600d2f59557ef943b1dedd65a2bc2c320

SHA512
27d75e7b62310c0203b71a57d296798a5201d3b7ead5fa946073a328ace9174f66f540069587ea982d84dd603f5181b98ca6ace1df654c8f6068dc520cc7dab2

Download Submit
memory/3056-30-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/3056-31-0x00000000027C4000-0x00000000027C5000-memory.dmp

Filesize
4KB

Download
memory/3056-33-0x00000000027C0000-0x00000000027C6000-memory.dmp

Filesize
24KB

Download
memory/3056-36-0x00000000027C4000-0x00000000027C5000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing