3e8264562cd88ca14452999d471237be1d20cbbe6a7f310259b4f22ff6bd5eff

General

Target

d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
Size

913KB
MD5

d2331d9d3ac05848e8550ae6740ee25c
SHA1

136450dd8662edd336fd2f1bd5a3712eeaddfa33
SHA256

3e8264562cd88ca14452999d471237be1d20cbbe6a7f310259b4f22ff6bd5eff
SHA512

317bc84f35d87abda0665ba160c1e683c9ef85a2ae676b9be22d400aa93d716cdc6a42634f99d7a2ffa9ca48412585ac08ac7a8ac4abf76ac3f6189c21183742
SSDEEP

24576:E0Qi1ZDezSQzIGCOKb3Aih50eaQU5mHIRsUTSejHzPoeeMc34p8345jNpZvon22+:Tn1IOQzIGCOKb3Aih50eaQU5mHIRsUTF

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1308	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
1308	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
1308	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
1308	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1908 wrote to memory of 1732	1908	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	30
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31
PID 1732 wrote to memory of 1308	1732	d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d2331d9d3ac05848e8550ae6740ee25c_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Fq1C1H7qY19tDJL\1LDaKZKB5HfI.dll

Filesize
76KB

MD5
8d846381b5d810516eae3e524e642cf3

SHA1
63625f701ee3a41ff9c254fcf76fc1b23a8d4ee1

SHA256
93f22e354bd43ff42c88fa83f1ddc2ba2cd68624a948cd94c86a0a15c0167b71

SHA512
7a38f6eac6fa7a26919795dd5d57f474ed8b9de32b8304896000237a11cf9ebf8a935f732ede830d4fd71cd30514a9fcf9271352e9b0b271509d8f12be54f1e7

Download Submit
\Users\Admin\AppData\Local\Temp\Fq1C1H7qY19tDJL\2PKD0hF.dll

Filesize
202KB

MD5
7160ebc558a797f0dae8e1a4b24ed184

SHA1
1a08fd01e298d949ad93109fbc4870a28cfe6660

SHA256
cc19c4d2c90fb690db678846bc5545c134e0eca10a2d75cce1bb4f49c3428ef4

SHA512
b1a44e50f30f74fe75fddf9643368dbb22bfabbb1a72b710c8242d177fda4e0327f069ac3fa2bbb92ffe8554dd72509121336d316a272672d25e480e25692826

Download Submit
\Users\Admin\AppData\Local\Temp\Fq1C1H7qY19tDJL\UugHSsEez1SsaBz1bCz1Ttz1fGhI67jKCc.dll

Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
\Users\Admin\AppData\Local\Temp\Fq1C1H7qY19tDJL\lua51.dll

Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
memory/1308-18-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Filesize
64KB

Download
memory/1308-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-20-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-28-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/1308-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-24-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/1308-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1308-10-0x0000000000270000-0x00000000002A7000-memory.dmp

Filesize
220KB

Download
memory/1308-25-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/1308-5-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/1308-26-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/1308-27-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing