71df41b82a180890cfea1f5bd83ecb23852d170a22df58bd80637af6b0a39f75

General

Target

b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
Size

710KB
MD5

b0f9c5d0f90d38d9d93db73e2c33c25b
SHA1

0acd7421f3ecd0abae95ecf37c37c1d9618343c0
SHA256

71df41b82a180890cfea1f5bd83ecb23852d170a22df58bd80637af6b0a39f75
SHA512

3d14e7da3020bebef8c5085615377514264ca75f7345cebefc5b7c202c7b012c2b4acd26369d953b1ec8186b300499d8bd34005a9fdeff8a63e81809a85f274f
SSDEEP

12288:D5OHH9t0ATT5FH3B8BXrmBriIgvUJypEYCAK7RlBO4ybC4nTXtn5v5AiTGsNYon3:DIEA/gk7ypzK7RlBO4cCuTdnF5CsNX6i

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\hahagame\Skins\怀旧木纹.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\怀旧木纹.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\__tmp_rar_sfx_access_check_259431316	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\兰色沉思.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\简约之美.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\Office2007.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\灰色轨迹.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\828la.exe	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\金色年华.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\冬季恋歌.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\冬季恋歌.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\蔚蓝天际.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\金色年华.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\Office2003.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\金属之美.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\蔚蓝天际.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\Office2007.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\兰色沉思.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\Office2003.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\简约之美.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\金属之美.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File created	C:\Program Files (x86)\hahagame\Skins\青葱岁月.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\灰色轨迹.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\青葱岁月.asz	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0f9c5d0f90d38d9d93db73e2c33c25b_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing