98d02aa5770bb0a77044dc032c111bedaccf43fcefb0751d3c55c7cbac7daad6

General

Target

eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe
Size

595KB
MD5

eab9d8e3c4129fba3cef49f15408afc9
SHA1

5ec4f1accdfc77a7deef704c70663999d6953ecd
SHA256

98d02aa5770bb0a77044dc032c111bedaccf43fcefb0751d3c55c7cbac7daad6
SHA512

4c9fa6df47201c7b885243cdeea88a3c1920ecf7ac556dcd16cea28514c395826fc307e57ddce1005a78e711e4cdd5da0ec1ab4b1af2719886dbf18fbe593bab
SSDEEP

6144:7yH7xOc6H5c6HcT66vlmKhggtWKdC9UGy+DTPL1vMi3AYXZq/azNQXVMGhR/tO5k:7aqFlXTPhvHA7azeJjtrHS0aDale9A

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1704	svchost.exe
2620	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe
2288	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1704	svchost.exe
1704	svchost.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1704	2512	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe	29
PID 2512 wrote to memory of 1704	2512	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe	29
PID 2512 wrote to memory of 1704	2512	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe	29
PID 2512 wrote to memory of 1704	2512	eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe	29
PID 1704 wrote to memory of 2620	1704	svchost.exe	30
PID 1704 wrote to memory of 2620	1704	svchost.exe	30
PID 1704 wrote to memory of 2620	1704	svchost.exe	30
PID 1704 wrote to memory of 2620	1704	svchost.exe	30

C:\Users\Admin\AppData\Local\Temp\eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2620

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
35KB

MD5
345861f739ef259c33abc7ef49b81694

SHA1
3b6aff327d91e66a207c0557eac6ddefab104598

SHA256
fc3220611aded768e37b125c4e4d5a8ffdbf7dfa8d8c19c07c7791b486457948

SHA512
7b0aae948a594f29125a3e80f6c2b51421cda07f5ee4554538037f12b87d4b3937ee74fb400505efcd2a953c897a49d79d875148516dcef619c514251854dfad

Download Submit
\Users\Admin\AppData\Local\Temp\eab9d8e3c4129fba3cef49f15408afc9_JaffaCakes118.exe

Filesize
559KB

MD5
5270681173d716798f156f336091623e

SHA1
53d7c7336bfc7d8b724fb9893ec6a0ab89d88d65

SHA256
1b02960e8d07c23c6030cfa814a3e18082177dc34f39962a5f0d317725386d95

SHA512
c2b5cac19c353e2e9f20fcbc20f595d4bafdbe354fce81a1faba9b8212108194830086a54813709621e945981d750efe8c03647ff4351f567b960770fa2c7bdd

Download Submit
memory/1704-19-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2288-22-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2288-34-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2512-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing