8c6865afb5235d0d3b3decff70216a06e9d3b1028fcf38e5984cb76c1b0caa7e

General

Target

a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe
Size

996KB
MD5

a6514cdf14bfe0a45c5348e5f605af9f
SHA1

f62fde5330edf97c245f9075cb144cedbf0950ba
SHA256

8c6865afb5235d0d3b3decff70216a06e9d3b1028fcf38e5984cb76c1b0caa7e
SHA512

703d2e122990ec1b533c51db4f20f6547d980b980c486d9adf6ab8765a8b6c6f3d96524e082c2a42a94c070d5d597339622d25baa27420f335e9549c33e23043
SSDEEP

24576:bAhu8R3PZxx7DUFdqgpuPSO/ymEDPqzofxwG+b:8huWR7EdpuHydZpwZ

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	123.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	123.exe

Executes dropped EXE 4 IoCs

pid	Process
3692	123.exe
2648	1Pack.exe
3152	123.exe
3664	1Pack.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3496	2648	WerFault.exe	85
1960	3664	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1Pack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1Pack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3692	3828	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe	84
PID 3828 wrote to memory of 3692	3828	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe	84
PID 3828 wrote to memory of 3692	3828	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe	84
PID 3692 wrote to memory of 2648	3692	123.exe	85
PID 3692 wrote to memory of 2648	3692	123.exe	85
PID 3692 wrote to memory of 2648	3692	123.exe	85
PID 3828 wrote to memory of 3152	3828	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe	86
PID 3828 wrote to memory of 3152	3828	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe	86
PID 3828 wrote to memory of 3152	3828	a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe	86
PID 3152 wrote to memory of 3664	3152	123.exe	91
PID 3152 wrote to memory of 3664	3152	123.exe	91
PID 3152 wrote to memory of 3664	3152	123.exe	91

C:\Users\Admin\AppData\Local\Temp\a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6514cdf14bfe0a45c5348e5f605af9f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Users\Admin\AppData\Local\Temp\1Pack.exe
    "C:\Users\Admin\AppData\Local\Temp\1Pack.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 624
      4⤵
      Program crash
      PID:3496
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\1Pack.exe
    "C:\Users\Admin\AppData\Local\Temp\1Pack.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 620
      4⤵
      Program crash
      PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2648 -ip 2648
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3664 -ip 3664
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1Pack.exe

Filesize
612KB

MD5
e19cfdf3e47185947bd9a9fa76c33329

SHA1
301ce139bb65d63446f607767b7316244f6a1acd

SHA256
80296ad5b365a89dd522f43ba3bf868e05eee266860789d373e21a9dab07cddd

SHA512
d454fea68d13d3e51cef740c4186f591a02673fb0b730ff96c0d7ca428e8ddce3b9cf8fae8f9cc6f36c909723e2f9ab008bb3c2264f962d5a9fd05b4e88ed545

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.exe

Filesize
1.1MB

MD5
a140868b8ecaba317b635e3a6e055928

SHA1
19f1a71dc2322c51823571512b039924658b6bd7

SHA256
5810472eeb63780520f4ac6ec7b497f9f1bd1025f3e7dc7d21f5494d6ab2bb3e

SHA512
34314623f3e45bbe7bd3c61f72fa2f45e8c4e41520e62bfbcb5a9872af75db941d2fb42aa7ef112f2fbc533de7c637d1f232151199d7e8e3232ee345d541b9bc

Download Submit
memory/2648-33-0x0000000000400000-0x00000000004C6E64-memory.dmp

Filesize
795KB

Download
memory/2648-26-0x00000000004C6000-0x00000000004C7000-memory.dmp

Filesize
4KB

Download
memory/2648-25-0x0000000000400000-0x00000000004C6E64-memory.dmp

Filesize
795KB

Download
memory/3152-29-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/3664-34-0x0000000000400000-0x00000000004C6E64-memory.dmp

Filesize
795KB

Download
memory/3692-15-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/3692-24-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/3828-9-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-0-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-6-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-7-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/3828-3-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-4-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-8-0x0000000001001000-0x000000000100B000-memory.dmp

Filesize
40KB

Download
memory/3828-5-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-30-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/3828-32-0x0000000001000000-0x00000000011B1000-memory.dmp

Filesize
1.7MB

Download
memory/3828-2-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/3828-1-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads