0bb29b185d99135632b822e5c4db42f2959f9e1c87d710c50f0e38b3de4fbd56

General

Target

e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe
Size

319KB
MD5

e13a8a9d973f08811f348aa3ef3c8f77
SHA1

a6b4023d1447144e4030e196743803ce86a5eb5e
SHA256

0bb29b185d99135632b822e5c4db42f2959f9e1c87d710c50f0e38b3de4fbd56
SHA512

55cb82b903867bec3ae67e1bb24bdafde5bcd3656f8f545db5c5b26df58e5f1f4461daaf2acc2a46ee930d9bd1ff6f189e8a94267fef277a52b392e78553531b
SSDEEP

6144:/0IZ0/J8lG4tLwqCWkvaa5dVcVe9EXC74aR+UumBaa5G:MIZIJ8lG4tH8L542f4AVa3

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1272	Server_Setup.exe
824	WinXPs.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 3868	824	WinXPs.com	94

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinXPs.com	Server_Setup.exe
File created	C:\Windows\uninstal.bat	Server_Setup.exe
File created	C:\Windows\WinXPs.com	Server_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2068	1272	WerFault.exe	84
464	824	WerFault.exe	91
2896	3868	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinXPs.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	Server_Setup.exe
Token: SeDebugPrivilege	824	WinXPs.com

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1272	1728	e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe	84
PID 1728 wrote to memory of 1272	1728	e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe	84
PID 1728 wrote to memory of 1272	1728	e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe	84
PID 824 wrote to memory of 3868	824	WinXPs.com	94
PID 824 wrote to memory of 3868	824	WinXPs.com	94
PID 824 wrote to memory of 3868	824	WinXPs.com	94
PID 824 wrote to memory of 3868	824	WinXPs.com	94
PID 824 wrote to memory of 3868	824	WinXPs.com	94
PID 1272 wrote to memory of 4756	1272	Server_Setup.exe	95
PID 1272 wrote to memory of 4756	1272	Server_Setup.exe	95
PID 1272 wrote to memory of 4756	1272	Server_Setup.exe	95

C:\Users\Admin\AppData\Local\Temp\e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e13a8a9d973f08811f348aa3ef3c8f77_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 516
    3⤵
    - Program crash
    PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1272 -ip 1272
1⤵
PID:1888

C:\Windows\WinXPs.com
C:\Windows\WinXPs.com
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 516
  2⤵
  - Program crash
  PID:464
- C:\WINDOWS\SysWOW64\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  2⤵
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 12
    3⤵
    - Program crash
    PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 824 -ip 824
1⤵
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3868 -ip 3868
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe

Filesize
297KB

MD5
8da5f1bc35ed42bb279ea9cb139dd882

SHA1
0d8f85b04e5e6832a62094eaf58b0fad34e7a3a5

SHA256
13f12448188f279e85abdf85ea414a99908a27d45e2afec0c97f88334761505d

SHA512
51fee5427cdd41ba6476ae41f7075aef423f4ca019784e89525ac9a318b90e9dcdc7076f3a7f577a5e4585a1d041062bb556a43d94c2c2937abc64afe2aae651

Download Submit
C:\Windows\uninstal.bat

Filesize
150B

MD5
62910137f26a7556f8455428a5552794

SHA1
ccc0eff43a5d1a26a6bf96f592782b1089249cf6

SHA256
f419ad8b229fc195a23cb31b21c444030053738baa5e1de8cc158746a318cedd

SHA512
a8a1a4b661caf26d13469ddd0fa54b275d668caa7846f53b4af4f6b3a1558c0689c9f8280fc1fa843671cb7638ce0bcc78cfe97035d1522781b805aa2bfcf912

Download Submit
memory/824-18-0x0000000000400000-0x0000000000505E07-memory.dmp

Filesize
1.0MB

Download
memory/824-19-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/824-25-0x0000000000400000-0x0000000000505E07-memory.dmp

Filesize
1.0MB

Download
memory/1272-10-0x0000000000400000-0x0000000000505E07-memory.dmp

Filesize
1.0MB

Download
memory/1272-12-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1272-13-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1272-23-0x0000000000400000-0x0000000000505E07-memory.dmp

Filesize
1.0MB

Download
memory/3868-22-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing