a2633fe118601d6474efde725ab1858fff78677ccb60965f338ae682d13a9bfd

General

Target

dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe
Size

288KB
MD5

dfb990ebf283c764ca19c56d838cb400
SHA1

1434695a5547fef37c4a2f998a863aa0cc76de6f
SHA256

a2633fe118601d6474efde725ab1858fff78677ccb60965f338ae682d13a9bfd
SHA512

b88ab35a35f741579a14e49399058410be8cbad1e894cc04744eea75c80914b29a8642c147bab6a9256592d2373a18ee07e0b304269b2e0940b54e87a2af4908
SSDEEP

6144:Sqj25p07kaFVUczhTbVwRPvHjLQ0dg6l42o47ZwMwoTl:Hy5p07LVfhnV8PvHjLQ066lMEPPTl

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
3672	serveer.exe
396	serveer.exe
728	serveer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 396	3672	serveer.exe	87
PID 396 set thread context of 728	396	serveer.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4344	3672	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	serveer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	serveer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
728	serveer.exe
728	serveer.exe
728	serveer.exe
728	serveer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
396	serveer.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3672	4716	dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe	84
PID 4716 wrote to memory of 3672	4716	dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe	84
PID 4716 wrote to memory of 3672	4716	dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe	84
PID 3672 wrote to memory of 396	3672	serveer.exe	87
PID 3672 wrote to memory of 396	3672	serveer.exe	87
PID 3672 wrote to memory of 396	3672	serveer.exe	87
PID 3672 wrote to memory of 396	3672	serveer.exe	87
PID 3672 wrote to memory of 396	3672	serveer.exe	87
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 396 wrote to memory of 728	396	serveer.exe	90
PID 728 wrote to memory of 3444	728	serveer.exe	56
PID 728 wrote to memory of 3444	728	serveer.exe	56
PID 728 wrote to memory of 3444	728	serveer.exe	56
PID 728 wrote to memory of 3444	728	serveer.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dfb990ebf283c764ca19c56d838cb400_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\serveer.exe
    "C:\Users\Admin\AppData\Local\Temp\serveer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\serveer.exe
      "C:\Users\Admin\AppData\Local\Temp\serveer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\serveer.exe
        
        C:\Users\Admin\AppData\Local\Temp\serveer.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 448
      4⤵
      Program crash
      PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3672 -ip 3672
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\serveer.exe

Filesize
286KB

MD5
4887303ff79f6ed0242f92247ddef577

SHA1
71172fa679ed35c3a91e3c16790c10af4dcfbca0

SHA256
fb8b2977cc193db78e1a469b99adf9cc793fffe3bb25b76a9d5fae858e46b014

SHA512
c48d5bb76ea1e2ecd107247bff074f6c1997dc27fc25d63f98fbdc09f5f4050def279bdc5fc835c830325a72fe9f6f137d5fbd0775dff07f23ebfb3c42110acb

Download Submit
memory/396-8-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/396-11-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/396-22-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/728-16-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/728-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/728-19-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/728-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/728-29-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/3444-25-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3444-26-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3672-23-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing