c93ab3d12ec501186da540ff00a919fa54eb26a6c36bbea679875557199cc3b0

General

Target

d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe
Size

109KB
MD5

d05f047cb3322fc36b619783f558061f
SHA1

08ff68ef68ed069e7a4ea3f94361454da86ee5c7
SHA256

c93ab3d12ec501186da540ff00a919fa54eb26a6c36bbea679875557199cc3b0
SHA512

bd1b8de3b0c16e108970eb3ec6ec4ad2932812cc975343e60a894dafa976bf1440bcf79353f4fa37db899bd2d91f5646b51870447800b76488f2ac835370a79c
SSDEEP

3072:Bnj9PtfUKINndIc0Jj5lax4g+Nag+LqBPzyfo/TOODVgywp8QP:Bjnei9uLq1zy0Soiz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2896	samia-05.exe
2348	samia-05.exe

Loads dropped DLL 5 IoCs

pid	Process
828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe
828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe
2896	samia-05.exe
2896	samia-05.exe
2348	samia-05.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2348	2896	samia-05.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	samia-05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	samia-05.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	samia-05.exe
2348	samia-05.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 828 wrote to memory of 2896	828	d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe	31
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2896 wrote to memory of 2348	2896	samia-05.exe	32
PID 2348 wrote to memory of 1248	2348	samia-05.exe	21
PID 2348 wrote to memory of 1248	2348	samia-05.exe	21
PID 2348 wrote to memory of 1248	2348	samia-05.exe	21
PID 2348 wrote to memory of 1248	2348	samia-05.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1248
- C:\Users\Admin\AppData\Local\Temp\d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d05f047cb3322fc36b619783f558061f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\samia-05.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\samia-05.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\samia-05.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\samia-05.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\samia-05.exe

Filesize
61KB

MD5
72187ebeeb5777db307da07de53fee75

SHA1
2b3b7903e57f5c487f6f9d3b27bdf585475a92d1

SHA256
a31f8eeed0c13b37d651c38b9983a5f834495dfec04fff4654dd1dfba6d97fff

SHA512
2dba9e31defd0b406fb377214009b50681866569e588890efe655cd3c766b972de13d0b8852d182bc85fd684071eb705e95a6947a7a015cd8f99bae266ebc2d6

Download Submit
memory/1248-18-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1248-21-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2348-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2348-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2348-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads