47e6522a99d1bc8c709c24c29a792ace4cc5dfb559b5707f1ca828f521c23856

General

Target

c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
Size

13.4MB
MD5

c25595e2f8b0fca61679d7d1c5543a26
SHA1

be7071633afa01e89b3d38643253195a2fc49f8d
SHA256

47e6522a99d1bc8c709c24c29a792ace4cc5dfb559b5707f1ca828f521c23856
SHA512

09e071af1a9f87c9940fffb8d5bd4a06b6dd943327a4a82c062d331380337b499d66ee62d4ba298da588c1fe42995149a433e8690e3bf0f81246878c2557b402
SSDEEP

192:i2VAKqGxc49My2dNQOm49A476byj9zHJeyJ+43cDimP1oydUV8z5L/CldolMGoVj:iPqcxwAd+43cWQ1jUa1LCcM4aeWFz

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exeC:\\Windows\\Googlejo.exe"	Googlejo.exe

Deletes itself 1 IoCs

pid	Process
2552	Googlejo.exe

Executes dropped EXE 2 IoCs

pid	Process
3056	Googlejo.exe
2552	Googlejo.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Debugs.inf	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
File created	C:\Windows\Googlejo.exe	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
File opened for modification	C:\Windows\Googlejo.exe	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
File created	C:\Windows\Debugs.inf	Googlejo.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Googlejo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Googlejo.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3044	3028	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3044	3028	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3044	3028	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	30
PID 3028 wrote to memory of 3044	3028	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	30
PID 3044 wrote to memory of 3056	3044	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	31
PID 3044 wrote to memory of 3056	3044	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	31
PID 3044 wrote to memory of 3056	3044	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	31
PID 3044 wrote to memory of 3056	3044	c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe	31
PID 3056 wrote to memory of 2552	3056	Googlejo.exe	32
PID 3056 wrote to memory of 2552	3056	Googlejo.exe	32
PID 3056 wrote to memory of 2552	3056	Googlejo.exe	32
PID 3056 wrote to memory of 2552	3056	Googlejo.exe	32

C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c25595e2f8b0fca61679d7d1c5543a26_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\Googlejo.exe
    "C:\Windows\Googlejo.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\Googlejo.exe
      "C:\Windows\Googlejo.exe"
      4⤵
      Modifies WinLogon for persistence
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MyTemp

Filesize
84B

MD5
22df672e8d0b1534210797a96f0e3d57

SHA1
45db74465b0ae3a2ca5238635a6bf6652830810a

SHA256
908ea4508aa77257266215a5fd1c121f5e04fa715b52532f24c52f62be429fa1

SHA512
c8cf789c48a52dcba269a4c9f7f0864b2106440b2989aeaa5b1b9f273109693126d0c1813a9abd9f999f16108cfb26baa5c641d7e6b2d88c742844849f5198de

Download Submit
C:\Windows\Googlejo.exe

Filesize
34.1MB

MD5
c610263c1114984acabd5c28f0d1d618

SHA1
2e25a8913dce110e858617ba00dddd2fe14524d1

SHA256
87b1c62c9b756e5e9bb787d651fee260a381bb30ea3c1ebf044bdcc05ca71144

SHA512
9a25cefe22916403daea556b74831c843a4a778228b8673f116d18ffbd0cd2cdb0807c9b56bc80a14647b39046d3d2d578b615052c161f12a01de33ec0800805

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads