165d4956e83c452bda01fc241627d098f25851a47ae27f31b00e9765847ff50b

General

Target

c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe
Size

32KB
MD5

c18ebac8202f5d5699d241b6bcdcbfc9
SHA1

908953c4452b0744079e7a8d9df91fc4ee25f68f
SHA256

165d4956e83c452bda01fc241627d098f25851a47ae27f31b00e9765847ff50b
SHA512

234fae3962e75d151010660190aa66fe465bd45085d56a31d8010d055d77ab3f854af77e5f18a299dd89a335c097c127f6f47b267997ec5bb1f54b009319f632
SSDEEP

768:190/cl4T8n+7mJWD04oV2jQXL0KEUgTkIyo:Tf4TvmwDGjovNTvyo

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ljJBuvsR.dll	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ljJBuvsR.dll	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe
3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 612	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	5
PID 3460 wrote to memory of 3208	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	104
PID 3460 wrote to memory of 3208	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	104
PID 3460 wrote to memory of 3208	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	104
PID 3460 wrote to memory of 2308	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	105
PID 3460 wrote to memory of 2308	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	105
PID 3460 wrote to memory of 2308	3460	c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe	105

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Users\Admin\AppData\Local\Temp\c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ,a
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\c18ebac8202f5d5699d241b6bcdcbfc9_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4452,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
C:\Windows\SysWOW64\ljJBuvsR.dll

Filesize
24KB

MD5
03d1817c71b095272317360e52c2a187

SHA1
a8af1982dd2497d76e63157d4045345274d48702

SHA256
54d1a80d35dc3e4a246b39777fa383360ea532aa682f655c451b8dc695331521

SHA512
36cb029528c4654f56eab24e7a12a540581cbd3e5019bacb8c451ac76456322a834daab4c1ed5955f54e283041907aebe8b3cd872c7ee4abb4c57f4ca35a2a59

Download Submit
memory/3460-0-0x00000000004F0000-0x00000000004F7000-memory.dmp

Filesize
28KB

Download
memory/3460-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3460-8-0x0000000010010000-0x0000000010012000-memory.dmp

Filesize
8KB

Download
memory/3460-7-0x00000000004A0000-0x00000000004A5000-memory.dmp

Filesize
20KB

Download
memory/3460-9-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3460-10-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3460-11-0x00000000004F0000-0x00000000004F7000-memory.dmp

Filesize
28KB

Download
memory/3460-13-0x0000000010010000-0x0000000010012000-memory.dmp

Filesize
8KB

Download
memory/3460-12-0x00000000004A0000-0x00000000004A5000-memory.dmp

Filesize
20KB

Download
memory/3460-15-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing