8567c4a5cbfcac6683500d1a373c24636e895f27c1637945f99ade8f83ffb8f9

General

Target

ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
Size

39KB
MD5

ab2ed540ed09cf51adea66a59a426aab
SHA1

45d34eb06da2016efdbe5d82b20b627fc35e2e31
SHA256

8567c4a5cbfcac6683500d1a373c24636e895f27c1637945f99ade8f83ffb8f9
SHA512

accd066ddd6d839f194575e86bca964eb8391bd4b63838aad68caa128a7997ec1de3a48bbf75ceb3c917b0c2ba5568721049688c1e63e5ef06b6018b8ecfef83
SSDEEP

768:SzLoYj/s3MY2C162DG9pFz6uEpYJgiMgIf2aNBIFZCzccx5BXPoQ:0MYQ3n2WTczxqYJgHf2aNBSZ5cx5FZ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
3392	msedge.exe
1620	msedge.exe
4660	msedge.exe
2488	msedge.exe
4340	msedge.exe
2432	msedge.exe
4676	msedge.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2648 set thread context of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 3392 set thread context of 1620	3392	msedge.exe	105

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\3S6UJ4s8.com	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
4640	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 2648 wrote to memory of 4640	2648	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	91
PID 4640 wrote to memory of 3392	4640	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	104
PID 4640 wrote to memory of 3392	4640	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	104
PID 4640 wrote to memory of 3392	4640	ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe	104
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 3392 wrote to memory of 1620	3392	msedge.exe	105
PID 1620 wrote to memory of 3988	1620	msedge.exe	107
PID 1620 wrote to memory of 3988	1620	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" DEL:C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" DEL:C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge .exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge .exe" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" DEL:C:\Users\Admin\AppData\Local\Temp\ab2ed540ed09cf51adea66a59a426aab_JaffaCakes118.exe
        5⤵
        
        PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1316,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
1⤵
PID:1568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5384,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
1⤵
- Executes dropped EXE
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=5336,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
1⤵
- Executes dropped EXE
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5784,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
1⤵
- Executes dropped EXE
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5800,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
1⤵
- Executes dropped EXE
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5736,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
1⤵
- Executes dropped EXE
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Filesize
39KB

MD5
9c72027fa7ed8e0d952a81f90fe4a3a3

SHA1
d86ecdab2a4a1debe8f1df40a2c6e29c26780594

SHA256
d3a7ab2abd4909f5884beda26fe79897e1774ea3039c6ab2dfad36d84525b04d

SHA512
b87e3c2f8875075a24d0ba02ce4e447893f80898b8f8b069e7651338ea1883239b6e854c179e41533d8e87c8e078e45c8661f465b9f4aa03b6059d9580a08eee

Download Submit
memory/4640-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4640-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4640-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4640-4-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing