f460fcb91b3f4ebd7cb4b9ae47e02b1393aac113e48c9c6084b1998313914d5d

General

Target

e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
Size

327KB
MD5

e096e1728d4b77134287af40f931c47a
SHA1

7a9bfed71f9bb344466eddf407913cbcc0f7c864
SHA256

f460fcb91b3f4ebd7cb4b9ae47e02b1393aac113e48c9c6084b1998313914d5d
SHA512

ab0419e1d76edbbe909708d0893cce45179bc93a9a4f60e5ff7a4f8dbaa463243acd247390b077ff7d0f5422299a5e35ca7fe32c5cd8787e2842f1fbc8827da7
SSDEEP

6144:dIF2idZecnl20lHRxp3ghkRGTGY/KqVk/2do7v2Oi9uwU5426f:dYF3Z4mxxUiUoO6iZU54n

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2700	2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2700	2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2700	2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2700	2396	e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\E096E1~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2700

C:\Windows\SysWOW64\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
C:\Windows\SysWOW64\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\e096e1728d4b77134287af40f931c47a_JaffaCakes118.exe

Filesize
327KB

MD5
e096e1728d4b77134287af40f931c47a

SHA1
7a9bfed71f9bb344466eddf407913cbcc0f7c864

SHA256
f460fcb91b3f4ebd7cb4b9ae47e02b1393aac113e48c9c6084b1998313914d5d

SHA512
ab0419e1d76edbbe909708d0893cce45179bc93a9a4f60e5ff7a4f8dbaa463243acd247390b077ff7d0f5422299a5e35ca7fe32c5cd8787e2842f1fbc8827da7

Download Submit
memory/2396-13-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-11-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-26-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-25-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-24-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-23-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-22-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-21-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-12-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-19-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-18-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-17-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-16-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-15-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-27-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-14-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2396-20-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/2396-10-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2396-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2396-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2396-7-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2396-6-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2396-5-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2396-4-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2396-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2396-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2396-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2396-32-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/2396-33-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2688-30-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2688-34-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download

Analysis

Sharing