1c4c9c5919fb56d9baddec82db1e70c100a076c7f564a303eb1a9bd3f7691a25

General

Target

dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe
Size

2.5MB
MD5

dde2ab0508ef2a2f9f75a4bc1a2ce0f3
SHA1

80528701d3b7ebdbbee928eb7dbd96d115b4d455
SHA256

1c4c9c5919fb56d9baddec82db1e70c100a076c7f564a303eb1a9bd3f7691a25
SHA512

ca733c64d66beec8b6e982bb8d6debb6eec16afa27b76cc5f4915333c15571b39541eb4a8fa146da4b0b914ab3372e330d95d63edd7475bfe0ecd538a163062a
SSDEEP

49152:L2HblkiCJyDJayNEHW+Unj/2JBmpW2YNOJAZPmA92KCnt77aLYUqNjj0blHnSq:CRkiCJobNEH4njY6oOM2KOBaLYU0Qxf

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe
2468	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp
2468	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp
2468	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2468	2348	dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\is-P6F5L.tmp\dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P6F5L.tmp\dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp" /SL5="$50150,2345339,54272,C:\Users\Admin\AppData\Local\Temp\dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-9LC1P.tmp\FileDeEx.dll

Filesize
364KB

MD5
b576264e3ce8a993b0b0f00d2f45b5d4

SHA1
2aa87b5e08f7f5ea3e2753d5e9cc0a854add534d

SHA256
8eb3957feae73ef672d29850d29cb12ac4382d29dd76355bfb5879fa36b6b4c3

SHA512
562f7889c4f771d31cb58096dbe286fd1ce241af2900f7dd142b812ba74991c3eaccc61bfa188e3ad4ff81874fbf1ec14eb1e0ea73796f5668285ec2624ecec2

Download Submit
\Users\Admin\AppData\Local\Temp\is-9LC1P.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-P6F5L.tmp\dde2ab0508ef2a2f9f75a4bc1a2ce0f3_JaffaCakes118.tmp

Filesize
680KB

MD5
0fed0ac6b23dd0774476bf124ffaf9d4

SHA1
7b67a702d1ed31597fcb45b79e894f1303cb7b98

SHA256
fc516517a9796d1c45dd8c883feec1aa6952d7cf713eaec9ae6069265de35964

SHA512
2728923e238b5a7d3d7eb25855c1aa9c54e1db5bad3039cf4709371a25cc857e63611b8beba78c39965aedc852e4234b70b52d4e793d797ec57f979e9ab61a98

Download Submit
memory/2348-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2348-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2348-21-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2468-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2468-19-0x0000000003900000-0x0000000003961000-memory.dmp

Filesize
388KB

Download
memory/2468-23-0x0000000003900000-0x0000000003961000-memory.dmp

Filesize
388KB

Download
memory/2468-22-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing