25b02edfa3c5e682465dd77074fcbbc46c020fbfb776c3ece4fa988714bbe2a7

General

Target

c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe
Size

4.1MB
MD5

c7c90bd05b50dc9680fa2534088c6d16
SHA1

c5643acde3624ea9baa36e1b192049c6b5452882
SHA256

25b02edfa3c5e682465dd77074fcbbc46c020fbfb776c3ece4fa988714bbe2a7
SHA512

4339a754da8234e955c960cf0db08b2d235d1f3d457d09f94fe06d00705891fb08f20ebe7ac5b2503044c9c79ecfb771d36eb5760c8a4775cb5d7bdae48ba9c0
SSDEEP

98304:QrIfJGonKVb3Gp+/ew74o0jVIUOr6kr+TQJ8XhnsaID:QUfCEpo7VOIRHvJ8saID

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1948	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
4764	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
1948	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
1948	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
4764	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
4764	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 1948	404	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe	84
PID 404 wrote to memory of 1948	404	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe	84
PID 404 wrote to memory of 1948	404	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe	84
PID 1948 wrote to memory of 3256	1948	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp	92
PID 1948 wrote to memory of 3256	1948	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp	92
PID 1948 wrote to memory of 3256	1948	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp	92
PID 3256 wrote to memory of 4764	3256	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe	93
PID 3256 wrote to memory of 4764	3256	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe	93
PID 3256 wrote to memory of 4764	3256	c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\is-297H2.tmp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-297H2.tmp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp" /SL5="$80244,3869714,151040,C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe /LANG=en /SL5="$80244,3869714,151040,C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\is-D8I00.tmp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D8I00.tmp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp" /SL5="$90244,3869714,151040,C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe" /LANG=en /SL5="$80244,3869714,151040,C:\Users\Admin\AppData\Local\Temp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-297H2.tmp\c7c90bd05b50dc9680fa2534088c6d16_JaffaCakes118.tmp

Filesize
1.2MB

MD5
5576331531ea628d83b90682bce03f18

SHA1
a98be9b662b84319f35fdb81f1596086091d582d

SHA256
a7980ea6e8a1c3ea2affb2b5bc12d1d553e6f08bd24995e1f61dd80c56eb9506

SHA512
3d7c1f4599ecab98ee24756f199e367d83e6c2a1d7dfd6438331b387ae81ca4ec26025230e66e4800e2813493dc000ac9738292165c5018a9f5b855ada560852

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TH9PT.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TH9PT.tmp\ydwqk.dll

Filesize
1.6MB

MD5
fc4b0ea55c7632a0cd000bef5e658243

SHA1
71c8eaa31613a14faaa4634f0d402cb3b8285456

SHA256
2c4658c487114e36e2b9e75bf1c97dc034ce080dc6bc5f3a45e83aeb573dd631

SHA512
54744d9031736e57e03c2567c59586d8c0bbbf0743022ed1c8719a12c7347f4206341314b31a7656f42d1a201ddb4ef75d39be2681aed2e48c627e742068e149

Download Submit
C:\Users\Admin\AppData\Roaming\OneSystemCare\log\20240828i-2247.log

Filesize
5B

MD5
3bab25a3e651a9e4a00473d2257b99f9

SHA1
1419458f2696be8daeade77ddad380cd0c871fdb

SHA256
f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295

SHA512
ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff

Download Submit
memory/404-26-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/404-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/404-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/1948-22-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1948-16-0x00000000746B0000-0x0000000074853000-memory.dmp

Filesize
1.6MB

Download
memory/1948-17-0x00000000746B0000-0x0000000074853000-memory.dmp

Filesize
1.6MB

Download
memory/1948-6-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/1948-15-0x00000000746B0000-0x0000000074853000-memory.dmp

Filesize
1.6MB

Download
memory/1948-14-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download
memory/3256-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3256-41-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4764-37-0x00000000746B0000-0x0000000074853000-memory.dmp

Filesize
1.6MB

Download
memory/4764-38-0x00000000746B0000-0x0000000074853000-memory.dmp

Filesize
1.6MB

Download
memory/4764-39-0x00000000746B0000-0x0000000074853000-memory.dmp

Filesize
1.6MB

Download
memory/4764-42-0x0000000000400000-0x0000000000534000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing