05ea53accbd1aeb01dbc587d0d2176ca20f4fa7583b50dddca892de56e532e1f

General

Target

bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe
Size

303KB
MD5

bb24421555e93a49b70afb2b7d69d1fc
SHA1

46687b4dfbd7d1464fc725f32e4c8362745ad56d
SHA256

05ea53accbd1aeb01dbc587d0d2176ca20f4fa7583b50dddca892de56e532e1f
SHA512

159b0d59a611c94f6bc100cb2e0df018b454bcc8efb6e6ef82516c45c2c11ed551547562e29e536d1896166ebbc354a4da6754dd87c7864121255d251003f6c4
SSDEEP

6144:+yH7xOc6H5c6HcT66vlmeM2HYjopUlgIVA4Fnisna:+abIqUlgUFn0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2468	svchost.exe
1724	bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe
5080	svchost.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\UndoConvertFrom.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 2468	1000	bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe	84
PID 1000 wrote to memory of 2468	1000	bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe	84
PID 1000 wrote to memory of 2468	1000	bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe	84
PID 2468 wrote to memory of 1724	2468	svchost.exe	85
PID 2468 wrote to memory of 1724	2468	svchost.exe	85
PID 2468 wrote to memory of 1724	2468	svchost.exe	85

C:\Users\Admin\AppData\Local\Temp\bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    PID:1724

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bb24421555e93a49b70afb2b7d69d1fc_JaffaCakes118.exe

Filesize
267KB

MD5
0a67382a171ecd2f39250a70f75152dd

SHA1
e1ad97d525097aded5c4f5d5891bb5475bdbffdf

SHA256
467fd03eb81161a88408d7e3de6ca6ad4f75e98204eee2d7da6016f67e23b998

SHA512
a9138fefceaaff8b04f330554a88e980cb2b63fb036e9532edee274e83b4fe63e8fe8326e427d608609cf9bd84eb4d1c34dfdab3add09cba9d52a4680f82a38a

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
memory/1000-3-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2468-10-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5080-13-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5080-19-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing