6a3ffb14e8ea88b6540e0bbb8d6a490af674e07791e1c317b47ee2a28d9b86e3

General

Target

e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe
Size

128KB
MD5

e0e383f8788e0fefb58345c997a258de
SHA1

2289aeb97afce5ca76f09dc9408cc4aadb0666d1
SHA256

6a3ffb14e8ea88b6540e0bbb8d6a490af674e07791e1c317b47ee2a28d9b86e3
SHA512

36b5353f11245ea71a7b9dd6648c83297df4a3f11dd402e9a79a2c48bfdf38296be628d3da0169042cb9e6fb4a3ff66a57c64604bf0ab4e5ea06265cf09692f1
SSDEEP

3072:FVmmmmmmmmmmmmmmmmmmmmm3mimmmmmmmmmm6mmmDzoX8yzpHSt5IqtT9wNewwkE:FVmmmmmmmmmmmmmmmmmmmmm3mimmmmmG

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2812	KB00503480.exe

Loads dropped DLL 2 IoCs

pid	Process
2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe
2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\KB00503480.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\KB00503480.exe\""	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB00503480.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe
2812	KB00503480.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2812	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2812	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2812	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2812	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2696	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2696	2240	e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0e383f8788e0fefb58345c997a258de_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Roaming\KB00503480.exe
  "C:\Users\Admin\AppData\Roaming\KB00503480.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\exp4569.tmp.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\exp4569.tmp.bat

Filesize
286B

MD5
228b8e215b99997e51304640d880038a

SHA1
e406331b46ce7652488a811de8e50625e5f7767e

SHA256
512272aef377130ba1f40e056038c9e9699cb1ef3df3e7bb62bf0bcb5a004349

SHA512
8ef18aec2bd93b61963b01c73b285ce3ebf23a2d007da8d680c2c210d5c8e049b86a1667ba46695252602df57187213202a9a3e804bd05f9cc534071e192c729

Download Submit
\Users\Admin\AppData\Roaming\KB00503480.exe

Filesize
128KB

MD5
e0e383f8788e0fefb58345c997a258de

SHA1
2289aeb97afce5ca76f09dc9408cc4aadb0666d1

SHA256
6a3ffb14e8ea88b6540e0bbb8d6a490af674e07791e1c317b47ee2a28d9b86e3

SHA512
36b5353f11245ea71a7b9dd6648c83297df4a3f11dd402e9a79a2c48bfdf38296be628d3da0169042cb9e6fb4a3ff66a57c64604bf0ab4e5ea06265cf09692f1

Download Submit
memory/2240-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2240-1-0x00000000002E0000-0x0000000000301000-memory.dmp

Filesize
132KB

Download
memory/2240-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2240-3-0x0000000000310000-0x0000000000335000-memory.dmp

Filesize
148KB

Download
memory/2812-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-17-0x0000000000290000-0x00000000002B5000-memory.dmp

Filesize
148KB

Download
memory/2812-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-16-0x0000000000250000-0x0000000000271000-memory.dmp

Filesize
132KB

Download
memory/2812-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads