49b9921524de854116895da348af8a102d654759048ccb4d052831c212867b96

General

Target

ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe
Size

1.3MB
MD5

ea363ec3d656bc04d24ddc3dbf92a7f7
SHA1

7d80a71ead84ee5c4d1bca3f33ca8ada269df064
SHA256

49b9921524de854116895da348af8a102d654759048ccb4d052831c212867b96
SHA512

e167ce69b2266605f55d65c0d104570f9b32167e4c4f83b1805f68e83d81fed06e4fd837234a4cc8e41c9ddbec37f46868e71e873a0d764ffc7133f71a7a6828
SSDEEP

24576:k2u6pZDxaVHFcfE3COlJ1o27d0jGy71w3AZNb3k924ZdltoZf627iYglam///LZR:D9pCYbOL627c91dbiTZ7tUfXiflamHFR

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SysInternals\ProcExp.chm	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\SysInternals\ProcExp.chm	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe
File created	C:\Program Files (x86)\SysInternals\ProcExp.exe	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\SysInternals\ProcExp.exe	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2280	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	82
PID 668 wrote to memory of 2280	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	82
PID 668 wrote to memory of 2280	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	82
PID 2280 wrote to memory of 4176	2280	cmd.exe	84
PID 2280 wrote to memory of 4176	2280	cmd.exe	84
PID 2280 wrote to memory of 4176	2280	cmd.exe	84
PID 668 wrote to memory of 3580	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	85
PID 668 wrote to memory of 3580	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	85
PID 668 wrote to memory of 3580	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	85
PID 3580 wrote to memory of 4052	3580	cmd.exe	87
PID 3580 wrote to memory of 4052	3580	cmd.exe	87
PID 3580 wrote to memory of 4052	3580	cmd.exe	87
PID 668 wrote to memory of 2996	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	88
PID 668 wrote to memory of 2996	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	88
PID 668 wrote to memory of 2996	668	ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe	88
PID 2996 wrote to memory of 1296	2996	cmd.exe	90
PID 2996 wrote to memory of 1296	2996	cmd.exe	90
PID 2996 wrote to memory of 1296	2996	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea363ec3d656bc04d24ddc3dbf92a7f7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Sysinternals\Process Explorer" /f /v EulaAccepted /t REG_DWORD /d 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Sysinternals\Process Explorer" /f /v EulaAccepted /t REG_DWORD /d 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Sysinternals\Process Explorer" /f /v AlwaysOntop /t REG_DWORD /d 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Sysinternals\Process Explorer" /f /v AlwaysOntop /t REG_DWORD /d 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Sysinternals\Process Explorer" /f /v OneInstance /t REG_DWORD /d 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Sysinternals\Process Explorer" /f /v OneInstance /t REG_DWORD /d 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1296