9fcc69bbd09d12dd9e083399a5eaa0cfd1fa913495b93ac5cf79746ab29fb696

General

Target

be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
Size

23KB
MD5

be911940cfa1e6e61e351673e04e87fa
SHA1

63ba7d27c0ddf0a5ec74227dc43d4eff05f5c46b
SHA256

9fcc69bbd09d12dd9e083399a5eaa0cfd1fa913495b93ac5cf79746ab29fb696
SHA512

cdff5c4dd1d64877fed048c0a157dc796b5a9006c94cb3a7cc6acb9bc55e120c273880ecd4e3cf124af4c36b50564d28e971996f4816869c91d92a8a5eb9795a
SSDEEP

384:+2F7GPfJnG3ZlQjQmjJSpzB+gujxqR9lHmzTGf8r:+2F7afJQzB+guMjQzTGf6

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2888	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2152	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
2152	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
2152	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2152	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2152	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2152	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2152	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	29
PID 2380 wrote to memory of 2888	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2888	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2888	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2888	2380	be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe	31
PID 2152 wrote to memory of 568	2152	svchost.exe	33
PID 2152 wrote to memory of 568	2152	svchost.exe	33
PID 2152 wrote to memory of 568	2152	svchost.exe	33
PID 2152 wrote to memory of 568	2152	svchost.exe	33

C:\Users\Admin\AppData\Local\Temp\be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\be911940cfa1e6e61e351673e04e87fa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\svchost.exe
  "C:\Users\Admin\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\902.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\1915.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\902.bat

Filesize
515B

MD5
040a530e391ff1e878073e4f76b2dd72

SHA1
845844ef3742aec931151eb7f5c6c37f0e20d38a

SHA256
0a1182c0b093500e9b5605d60e463df24bcb5bc2ae6a17db201da240ec62bdb6

SHA512
fd702c33591e1dc107a6f45d7be9f596a167f2346ba2bf40f396a14cf5c438069dab9ee2a28cb4eb3c295d357492efc1485e0395dbeda62f635bda7f1b2dd3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\1915.bat

Filesize
153B

MD5
10ccb49e1284a5e78166bfd6ca2ac136

SHA1
bb4d5a29912edaa1aae100ba391ae3b8e6fbfeda

SHA256
dc9559e8bcc70b6be1ee485283bd56535e87e9605ab3070f3cb1143f1576048e

SHA512
6e5c280180abc36fc4584db711a2e2f05a48a432b93cf741c63964a14312884bd4aa47ba91d594bea039d3ce48fe68bc58e0c231dc9127bf1aee42e8ee564dfb

Download Submit
C:\Users\Admin\services.exe

Filesize
128B

MD5
f09f35a5637839458e462e6350ecbce4

SHA1
0ae4f711ef5d6e9d26c611fd2c8c8ac45ecbf9e7

SHA256
38723a2e5e8a17aa7950dc008209944e898f69a7bd10a23c839d341e935fd5ca

SHA512
ab942f526272e456ed68a979f50202905ca903a141ed98443567b11ef0bf25a552d639051a01be58558122c58e3de07d749ee59ded36acf0c55cd91924d6ba11

Download Submit
C:\Users\Admin\svchost.exe

Filesize
23KB

MD5
be911940cfa1e6e61e351673e04e87fa

SHA1
63ba7d27c0ddf0a5ec74227dc43d4eff05f5c46b

SHA256
9fcc69bbd09d12dd9e083399a5eaa0cfd1fa913495b93ac5cf79746ab29fb696

SHA512
cdff5c4dd1d64877fed048c0a157dc796b5a9006c94cb3a7cc6acb9bc55e120c273880ecd4e3cf124af4c36b50564d28e971996f4816869c91d92a8a5eb9795a

Download Submit

Analysis

Sharing