09fe7418de08ba5494e93c2404556dde88a03f440ead6323a2c6ec36f23a0fc4

General

Target

cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
Size

187KB
MD5

cf4335ed8c85a5169f75e2436b92fbe1
SHA1

1d71b7f827ff9ae02fe187164fe1c7b10710750f
SHA256

09fe7418de08ba5494e93c2404556dde88a03f440ead6323a2c6ec36f23a0fc4
SHA512

2ec890419a273ccd363d4a3db571717ee6c9e40b290fd1c26f48c762cbf7cb4c63120c513c9b40aa87d7578f9be3b623d4566a6bbb17b1194742c4fbb9d97f48
SSDEEP

3072:CvWg4TmCXU/87n5gccccccccIWuAf6ul5LNjdaWK+Apa:oWbTA0EnNkX

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winpkem.exe

pid process

800 winpkem.exe

pid	process
800	winpkem.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update 94949499393 = "C:\\Windows\\8220558317972360\\winpkem.exe"	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 94949499393 = "C:\\Windows\\8220558317972360\\winpkem.exe"	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\8220558317972360\winpkem.exe	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
File opened for modification	C:\Windows\8220558317972360\winpkem.exe	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
File opened for modification	C:\Windows\8220558317972360	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1600 2936 WerFault.exe cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
4224 800 WerFault.exe winpkem.exe

pid	pid_target	process	target process
1600	2936	WerFault.exe	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
4224	800	WerFault.exe	winpkem.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exewinpkem.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winpkem.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe

description	pid	process	target process
PID 2936 wrote to memory of 800	2936	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe	winpkem.exe
PID 2936 wrote to memory of 800	2936	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe	winpkem.exe
PID 2936 wrote to memory of 800	2936	cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe	winpkem.exe

C:\Users\Admin\AppData\Local\Temp\cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf4335ed8c85a5169f75e2436b92fbe1_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\8220558317972360\winpkem.exe
C:\Windows\8220558317972360\winpkem.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 676
3⤵
- Program crash
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 356
2⤵
- Program crash
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2936 -ip 2936
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 800 -ip 800
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\8220558317972360\winpkem.exe

Filesize
187KB

MD5
cf4335ed8c85a5169f75e2436b92fbe1

SHA1
1d71b7f827ff9ae02fe187164fe1c7b10710750f

SHA256
09fe7418de08ba5494e93c2404556dde88a03f440ead6323a2c6ec36f23a0fc4

SHA512
2ec890419a273ccd363d4a3db571717ee6c9e40b290fd1c26f48c762cbf7cb4c63120c513c9b40aa87d7578f9be3b623d4566a6bbb17b1194742c4fbb9d97f48

Download Submit
memory/800-11-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/800-12-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/800-15-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/2936-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2936-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2936-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2936-8-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads