36b1e703ec42d277b63a639b350a1e6e163e8ac4acb5333f5e02dfd6a67582d2

General

Target

ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
Size

71KB
MD5

ad97669981dee0864376e6a0f0c914e9
SHA1

06378cb18e98ffa351572de80ccb150c9b54ff38
SHA256

36b1e703ec42d277b63a639b350a1e6e163e8ac4acb5333f5e02dfd6a67582d2
SHA512

eb8ca3c20bc370b32ba5e19fa62271c7aaca6a33320e7b27ee92ea3525ea87725edbded1f1f2b0d0768ff45c6cb399d9e8b2eda6c64398b1b661bbb3f4ecc489
SSDEEP

1536:eB2j5ZWIMbX921vLNLjZpjgEH1t+Mmd/jL:55ibX92xLhHjgEP+Mmdv

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2436	SoundSys.exe
3452	SoundSys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Sound = "\"C:\\Users\\Admin\\AppData\\Roaming\\SoundSys.exe\""	SoundSys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Sound = "\"C:\\Users\\Admin\\AppData\\Roaming\\SoundSys.exe\""	SoundSys.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 2436 set thread context of 3452	2436	SoundSys.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoundSys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoundSys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
4432	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
2436	SoundSys.exe
3452	SoundSys.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4732 wrote to memory of 4432	4732	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	84
PID 4432 wrote to memory of 2436	4432	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	86
PID 4432 wrote to memory of 2436	4432	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	86
PID 4432 wrote to memory of 2436	4432	ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe	86
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88
PID 2436 wrote to memory of 3452	2436	SoundSys.exe	88

C:\Users\Admin\AppData\Local\Temp\ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ad97669981dee0864376e6a0f0c914e9_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Users\Admin\AppData\Roaming\SoundSys.exe
    "C:\Users\Admin\AppData\Roaming\SoundSys.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Roaming\SoundSys.exe
      C:\Users\Admin\AppData\Roaming\SoundSys.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SoundSys.exe

Filesize
71KB

MD5
ad97669981dee0864376e6a0f0c914e9

SHA1
06378cb18e98ffa351572de80ccb150c9b54ff38

SHA256
36b1e703ec42d277b63a639b350a1e6e163e8ac4acb5333f5e02dfd6a67582d2

SHA512
eb8ca3c20bc370b32ba5e19fa62271c7aaca6a33320e7b27ee92ea3525ea87725edbded1f1f2b0d0768ff45c6cb399d9e8b2eda6c64398b1b661bbb3f4ecc489

Download Submit
memory/2436-31-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3452-35-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4432-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4432-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4432-23-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4732-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4732-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads