365d3d19e66de20d2ca5c259f9352b81b837067fbe7f0cbaaa006ccf05ded910

General

Target
d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe
Size 14KB
Sample240908-dbrgqstbjb
SHA256 365d3d19e66de20d2ca5c259f9352b81b837067fbe7f0cbaaa006ccf05ded910
MD5 d35cb8fafa041be53af3fb88b6758a47
SHA1 faf87bed5615f719cb81d4391899b36249bcc9e3
SHA512 4e9e4088e3f67b58ed34158eb66000cc3e80e462df50efa580d05accb291ed42cd8bf2e49d07d93494a5e5e92f90453e792f9719b95b171c79de1e6e774dd5cf
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRP:hDXWipuE+K3/SSHgxj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	DEMA321.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	DEMF99D.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	DEM9FAB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	DEMF6B4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	DEM4CC3.exe

Executes dropped EXE 6 IoCs

pid	Process
4368	DEM9FAB.exe
3976	DEMF6B4.exe
4644	DEM4CC3.exe
3820	DEMA321.exe
1740	DEMF99D.exe
4816	DEM5049.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM9FAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMF6B4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM4CC3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMA321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEMF99D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEM5049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4368	4984	d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe	88
PID 4984 wrote to memory of 4368	4984	d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe	88
PID 4984 wrote to memory of 4368	4984	d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe	88
PID 4368 wrote to memory of 3976	4368	DEM9FAB.exe	99
PID 4368 wrote to memory of 3976	4368	DEM9FAB.exe	99
PID 4368 wrote to memory of 3976	4368	DEM9FAB.exe	99
PID 3976 wrote to memory of 4644	3976	DEMF6B4.exe	101
PID 3976 wrote to memory of 4644	3976	DEMF6B4.exe	101
PID 3976 wrote to memory of 4644	3976	DEMF6B4.exe	101
PID 4644 wrote to memory of 3820	4644	DEM4CC3.exe	103
PID 4644 wrote to memory of 3820	4644	DEM4CC3.exe	103
PID 4644 wrote to memory of 3820	4644	DEM4CC3.exe	103
PID 3820 wrote to memory of 1740	3820	DEMA321.exe	105
PID 3820 wrote to memory of 1740	3820	DEMA321.exe	105
PID 3820 wrote to memory of 1740	3820	DEMA321.exe	105
PID 1740 wrote to memory of 4816	1740	DEMF99D.exe	107
PID 1740 wrote to memory of 4816	1740	DEMF99D.exe	107
PID 1740 wrote to memory of 4816	1740	DEMF99D.exe	107

C:\Users\Admin\AppData\Local\Temp\d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d35cb8fafa041be53af3fb88b6758a47_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\DEM9FAB.exe
  "C:\Users\Admin\AppData\Local\Temp\DEM9FAB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Users\Admin\AppData\Local\Temp\DEMF6B4.exe
    "C:\Users\Admin\AppData\Local\Temp\DEMF6B4.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\DEM4CC3.exe
      "C:\Users\Admin\AppData\Local\Temp\DEM4CC3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\DEMA321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMA321.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\DEMF99D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEMF99D.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\DEM5049.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DEM5049.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEM4CC3.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM4CC3.exe
Size 14KB
SHA256 cea9ec8d70de4b9029e2055b5d402de0d4736cb46f0a9582f7222e1c2a482c84
MD5 68e1f136fe65a1b41c086b0d6d4949f4
SHA1 763adfedd84ff667cf379a797699e5cccccb599b
SHA512 995aff38e07f450d61bb141a2a06ec2c8f3cf314cd061a74ec7d5a205f8a279acfd3ce075382996f1b7359c55bf7fbe6d341258733feaeef4873f593e67cad4f
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRC:hDXWipuE+K3/SSHgx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM5049.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM5049.exe
Size 14KB
SHA256 732716776413b4ab14310a0a3bf09abae716017f88e299d70200146db2373bf7
MD5 5ff48e2f184a3397c72f78bde1d631d8
SHA1 358c70af9b936e4c44dc9c583fcb3eaecc5ddb17
SHA512 dcefec65f192d308355703a67271e9e2f63599ce5f892b456c37569da5fa55e02fb15797fd720fb6142b9f139b2159549dc195d2388381cb71429cb8d0097a71
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRm:hDXWipuE+K3/SSHgxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEM9FAB.exe

Path C:\Users\Admin\AppData\Local\Temp\DEM9FAB.exe
Size 14KB
SHA256 9fcac5e29221d4337470e7ebd7feb105ed87307c109147c7ce16df1356349599
MD5 42c0626440c93e6333adffc6fb3f4273
SHA1 f64449e5a03e3626e4d0096617f70dc7752b893b
SHA512 cfd2a3467c51ecf074bfa202dff16b316a3143480e91e76cf5c00c8feb50d4f90f79e85e2571080a2321248fc19b049b93f66619ef1c3d3e9b9ec37ed18aefbe
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRB:hDXWipuE+K3/SSHgx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMA321.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMA321.exe
Size 14KB
SHA256 330651d64c1621f04db1d01b42bd5651231f57f7e1a65f0cf05fa6e6a271dba5
MD5 59391dc2b87bc9c6b97b5eeca46edb7a
SHA1 6bc160169ab88e057040a51740bae1335c150576
SHA512 38c809ed90af1dbf09fa350aaf4a5843c9e62e666473cfcb519624326158b13ad394f56accfce11f27a2ed3e41f1da567bb6f3098f9f192d5c5fef5e9fcdf40a
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRE:hDXWipuE+K3/SSHgx4
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMF6B4.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMF6B4.exe
Size 14KB
SHA256 ea734a44dcae2db76b40aea83afdae8250b838bf52d8b53530990ff169945a34
MD5 1e09acbf844bae41644e20b6ef5978dd
SHA1 116a8959a0d221571f3e077b371895122164bf0d
SHA512 b26e9a3f95d9bfdb6e53b868a2bd5bb99dc8198d23009fbc22bb76a3fb28d1b3138a5de7bb6ffaa313053afa864a55b202515c5aa423a7fa1671f13196ade4e9
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhRc:hDXWipuE+K3/SSHgxo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEMF99D.exe

Path C:\Users\Admin\AppData\Local\Temp\DEMF99D.exe
Size 14KB
SHA256 2f6562e0df3bcab2606090bbdff7413875ec969d577dcb08f28de568713187d1
MD5 cfb9195a5d8b2d95448f8fcdd928644f
SHA1 d9739394990c39b0438ce7ee1188ad9703a18f4f
SHA512 78c3d6195f779c846a91b41b468be18655eb7695d569cbb292a5a10b1a7ffd98ddfb6aabe6512a227e0c97cee752f3c47640037fedfe320650c6287b2833ad38
SSDEEP 384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhR/:hDXWipuE+K3/SSHgxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads