3cd40962ef4cd1383d275dc59828c48cc136b2d841f32b9c7446a0f8e1d7509f

General

Target

acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe
Size

591KB
MD5

acc4a93c1818ca616919c521ef4af756
SHA1

c5d7704d09b33a194a422a5ba333e0227489c99d
SHA256

3cd40962ef4cd1383d275dc59828c48cc136b2d841f32b9c7446a0f8e1d7509f
SHA512

73c112db06ed82e5b9a8041bfc5e6b0520a7dcf3562fa27fff434eb90c16b53564f773b11793e49fdb24aefba96f3a144a196db531a063540f3eedfd6d74c494
SSDEEP

12288:1GZFrUwTDJx/s0NDQTI9F3Z4mxxFnUqGGGkYThd5UcO+2Xp:qFrH9x/DNDQkQmXNUVGGk6PrOT

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2584	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	G_Server1.23.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\G_Server1.23.exe	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe
File opened for modification	C:\Windows\G_Server1.23.exe	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G_Server1.23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\System	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	G_Server1.23.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	G_Server1.23.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2584	2308	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe	33
PID 2308 wrote to memory of 2584	2308	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe	33
PID 2308 wrote to memory of 2584	2308	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe	33
PID 2308 wrote to memory of 2584	2308	acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe	33
PID 2772 wrote to memory of 2872	2772	G_Server1.23.exe	32
PID 2772 wrote to memory of 2872	2772	G_Server1.23.exe	32
PID 2772 wrote to memory of 2872	2772	G_Server1.23.exe	32
PID 2772 wrote to memory of 2872	2772	G_Server1.23.exe	32

C:\Users\Admin\AppData\Local\Temp\acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acc4a93c1818ca616919c521ef4af756_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2584

C:\Windows\G_Server1.23.exe
C:\Windows\G_Server1.23.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
fe05f06395925d12e5f8ee85621be4b6

SHA1
06e4ee7b2ca36b6cee2dd4709d9e3d85d43cbfa9

SHA256
ee6d3c0cbf4f15ee5010a9aa641eb9cb8fad17760775cf444996ebd8a34e7f63

SHA512
722b40c5694f79b3ceb6c77e8f4e6a8e7c089aa116604e526f47789d5c77fc53c25fd619be242f493ec86e038434c20e7a8ea51cf0ba46b1cbf68eeba38f0430

Download Submit
C:\Windows\G_Server1.23.exe

Filesize
591KB

MD5
acc4a93c1818ca616919c521ef4af756

SHA1
c5d7704d09b33a194a422a5ba333e0227489c99d

SHA256
3cd40962ef4cd1383d275dc59828c48cc136b2d841f32b9c7446a0f8e1d7509f

SHA512
73c112db06ed82e5b9a8041bfc5e6b0520a7dcf3562fa27fff434eb90c16b53564f773b11793e49fdb24aefba96f3a144a196db531a063540f3eedfd6d74c494

Download Submit
memory/2308-9-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2308-34-0x0000000001D50000-0x0000000001DA4000-memory.dmp

Filesize
336KB

Download
memory/2308-19-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2308-18-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/2308-17-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2308-16-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2308-15-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2308-14-0x00000000032B0000-0x00000000032B3000-memory.dmp

Filesize
12KB

Download
memory/2308-13-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2308-12-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2308-11-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/2308-10-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2308-20-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2308-0-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2308-21-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/2308-6-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2308-5-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2308-4-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2308-7-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2308-35-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2308-8-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x0000000001D50000-0x0000000001DA4000-memory.dmp

Filesize
336KB

Download
memory/2772-24-0x0000000000510000-0x0000000000564000-memory.dmp

Filesize
336KB

Download
memory/2772-23-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2772-37-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2772-38-0x0000000000510000-0x0000000000564000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing