2d10712bfe00368681e9d647e5e3a97a28fa030bf063765c1b73d4cd91e0fdf0

General

Target

b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
Size

33KB
MD5

b85ed8c2995bfa299bc33cbbf71049e4
SHA1

d5733039ae0490a240c2e382c35826d74cd815bd
SHA256

2d10712bfe00368681e9d647e5e3a97a28fa030bf063765c1b73d4cd91e0fdf0
SHA512

acda0c5cf6034f329efa178daeb0e8d1fbb8b798e40d61a6457db8767633d58fe22c286dd1c16c186d898f438d7583c518b3a593a5ec61bd61ef64e29f8223f5
SSDEEP

768:FU6lOwkh7JsymO9YF8N68dZxowwN41IoEt4wTbM1u+:kwilsymO9JFwN4Yjsh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2748	lsass.exe
2264	lsass.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\lsass.exe	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
File opened for modification	C:\Windows\lsass.exe	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
File created	C:\Windows\Debugs.inf	lsass.exe
File created	C:\Windows\Debugs.inf	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
2748	lsass.exe
2264	lsass.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2148	2644	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2748	2148	b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe	32
PID 2748 wrote to memory of 2264	2748	lsass.exe	33
PID 2748 wrote to memory of 2264	2748	lsass.exe	33
PID 2748 wrote to memory of 2264	2748	lsass.exe	33
PID 2748 wrote to memory of 2264	2748	lsass.exe	33
PID 2748 wrote to memory of 2264	2748	lsass.exe	33
PID 2748 wrote to memory of 2264	2748	lsass.exe	33
PID 2748 wrote to memory of 2264	2748	lsass.exe	33

C:\Users\Admin\AppData\Local\Temp\b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b85ed8c2995bfa299bc33cbbf71049e4_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\lsass.exe
    "C:\Windows\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\lsass.exe
      "C:\Windows\lsass.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\lsass.exe

Filesize
11.9MB

MD5
9aab577cc7ec737f236b00502d0fb93e

SHA1
833ea8554fb42c5810b275b2ae67520bbe0b6734

SHA256
50bc0919fc0d80b483ec36ab3f00fb3af9dd4b6e3d884d52849ed6288ae23c44

SHA512
493ad2e41be34c73718e6cb328ac081d005c48d64c7105adfc1a98fae9cedc2a84486672fdcbc6cfdfdc82d63a5b93884b9874b02f4ee857bf40b278c66359bc

Download Submit
memory/2148-16-0x0000000000420000-0x000000000043D000-memory.dmp

Filesize
116KB

Download
memory/2148-20-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2148-7-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2148-8-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/2148-9-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/2148-10-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2148-11-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2264-30-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2264-28-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/2264-27-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/2644-6-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2644-0-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2644-2-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2644-3-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/2644-4-0x0000000000419000-0x000000000041A000-memory.dmp

Filesize
4KB

Download
memory/2644-1-0x0000000000020000-0x000000000003D000-memory.dmp

Filesize
116KB

Download
memory/2748-22-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2748-25-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download
memory/2748-21-0x0000000000400000-0x000000000041C54E-memory.dmp

Filesize
113KB

Download

Analysis

Sharing