461d4555225bfc79610e53ce1666f852563ffa4d2c8084b5e67bf00e0adba6be

General

Target
cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe
Size 15KB
Sample240906-teqmlswama
SHA256 461d4555225bfc79610e53ce1666f852563ffa4d2c8084b5e67bf00e0adba6be
MD5 cfe8f500aa3c50db1df082ef92554c9a
SHA1 df9622a099ed5120966ddc4197591f7efe6b4c8e
SHA512 542fb82d39668e8fe680e17956d2861355ccf3a3a2f0f513b2cb810ec31be26ac45b5083bb353ab06dd932645560af11239d8dd9a2ad085c4047c5f08b17afe6
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HT0:hDXWipuE+K3/SSHgxmKEz0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEMB9C6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEM1033.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEMB602.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEMD2A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	DEM6368.exe

Executes dropped EXE 6 IoCs

pid	Process
3672	DEMB602.exe
4084	DEMD2A.exe
4820	DEM6368.exe
3868	DEMB9C6.exe
3996	DEM1033.exe
4360	DEM6651.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM6368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMB9C6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM1033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM6651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMB602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMD2A.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3672	1480	cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe	95
PID 1480 wrote to memory of 3672	1480	cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe	95
PID 1480 wrote to memory of 3672	1480	cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe	95
PID 3672 wrote to memory of 4084	3672	DEMB602.exe	99
PID 3672 wrote to memory of 4084	3672	DEMB602.exe	99
PID 3672 wrote to memory of 4084	3672	DEMB602.exe	99
PID 4084 wrote to memory of 4820	4084	DEMD2A.exe	101
PID 4084 wrote to memory of 4820	4084	DEMD2A.exe	101
PID 4084 wrote to memory of 4820	4084	DEMD2A.exe	101
PID 4820 wrote to memory of 3868	4820	DEM6368.exe	103
PID 4820 wrote to memory of 3868	4820	DEM6368.exe	103
PID 4820 wrote to memory of 3868	4820	DEM6368.exe	103
PID 3868 wrote to memory of 3996	3868	DEMB9C6.exe	105
PID 3868 wrote to memory of 3996	3868	DEMB9C6.exe	105
PID 3868 wrote to memory of 3996	3868	DEMB9C6.exe	105
PID 3996 wrote to memory of 4360	3996	DEM1033.exe	107
PID 3996 wrote to memory of 4360	3996	DEM1033.exe	107
PID 3996 wrote to memory of 4360	3996	DEM1033.exe	107

C:\Users\Admin\AppData\Local\Temp\cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfe8f500aa3c50db1df082ef92554c9a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\DEMB602.exe
  "C:\Users\Admin\AppData\Local\Temp\DEMB602.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\DEMD2A.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMD2A.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\DEM6368.exe
      "C:\Users\Admin\AppData\Local\Temp\DEM6368.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\DEMB9C6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMB9C6.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\DEM1033.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM1033.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\DEM6651.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM6651.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM1033.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM1033.exe
Size 15KB
SHA256 37e9d08f339be98203f292f5b0a4c9839403b02ee0b27e96df4ab00a53d2059c
MD5 7ebbb11fed2e42e11d4a24ec16cc533c
SHA1 c980a55407c792e533c5db9e1b621ab6f5352a07
SHA512 fff18725a85deafeea3e6821237a8ba4c20700d305f1b179737e3108414a87410af7aec3412402da6888f863b42c5a96d62ba394c29180088db89afca24fa8b8
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HT0:hDXWipuE+K3/SSHgxmKEz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM6368.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM6368.exe
Size 15KB
SHA256 edd646dbf9509497126b152ff5b8d2e1560cf24fa569a26b6e42c4a9215c142a
MD5 6418234ddb8d2b740a251b646d659390
SHA1 04be3f99cd73579ab3ecac8b5c5c4fb227dca341
SHA512 11a07c90711c980f502112034f7b2198fe7967d23761794d126c6c70025898ac6933ebf16d89df5eb5766f4145a1c229201b60a1bdc8f18d8ac6100a6d23a105
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HTQ:hDXWipuE+K3/SSHgxmKEzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM6651.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM6651.exe
Size 15KB
SHA256 7b465cda3dd3519c746f0ab0f67407af458aba26a45964121e30a521b7fcdd25
MD5 c5d453db4cd39a41ba41096167987086
SHA1 9eafd8d0553a9a4615396772f31200fa6f25c251
SHA512 3c1e980863c392795e23b870760689a438bbba5344c81f4189d575f720950b5fac9733125ed37a1237ee79545c10659fe62fdb9ce48e5930771b513b0d948865
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HT0:hDXWipuE+K3/SSHgxmKEz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMB602.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMB602.exe
Size 15KB
SHA256 b31c64439cb1896875fbc505cb31845237c780e42db5c9c4587ad6ff10b82fb0
MD5 11e40e0bff7b75e4fd47f888423e98d2
SHA1 735165118b9f5940718a98bacece27ed95f05618
SHA512 c49557919eb5fade051db7fc21fd64a9d57cc290bd612b1308fe869d82bdf6f8629ed1eaee04cf55878e75bb191fd142579bb9a07370033db9380122d49280e8
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HTp:hDXWipuE+K3/SSHgxmKEzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMB9C6.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMB9C6.exe
Size 15KB
SHA256 82de16e5d9e08bf01b4efcc16b8faae606ce726a098a35b0f6eb3b8d3e0e50ff
MD5 b03a8163b916b8cf9d3b2dec3b85a6a9
SHA1 c8e7fa5d2f3034fcc0499ac8162f09f0a9570f56
SHA512 0ca9c228ebf4b7ab7903be665c9f2d19bf3cae9441fe83ddd50f95f33b747411b30c1a234306cd73c1dfb763c834e01da0b3423f8269c719c8465e18aaf262d4
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HTE:hDXWipuE+K3/SSHgxmKEzE
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMD2A.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMD2A.exe
Size 15KB
SHA256 c6bcfa3bca420e92344a85fd50f47ff7146920f90985e54336468ede6ea64e9e
MD5 4f0c1f1af4b8cd3805c2b50f8e096637
SHA1 51e1d6b7f10818ca9a13a75896344afaddf65661
SHA512 91ba5c8654e6929d39e4745827e72509c71c0a2bab5909a8a107ccbaf8e06d5b18b8cdcf53a70e34f9ee29e07e17c22c632545530865d3bcee799ca755c8d236
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYKB2HTz:hDXWipuE+K3/SSHgxmKEzz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads