d5ef43c9c925ddc5c701e5fded7c4bb1cab18566d83ba8d86658b0258badc042

General

Target

eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
Size

18KB
MD5

eeaf1e8284f9062603d46bc7d6d3eb52
SHA1

fd1cd9e612d6b6cc3f410ae3a45ab4bd91d68ddc
SHA256

d5ef43c9c925ddc5c701e5fded7c4bb1cab18566d83ba8d86658b0258badc042
SHA512

64d735829eddde4ae43e374317bee9b3e43fcbb4f249130a0588619a3f87e91d35196d28d11987e6af68fb64353bfda9390af8948acf89a6e069a011f84fd2c7
SSDEEP

384:Q3YNOuELZKqjrBm04Q96EizKHnugElDsxRM3v405nfNzC2:QY8LZKEBm0f9Mq9El2E1zl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	GTH11569.exe

Loads dropped DLL 4 IoCs

pid	Process
2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
2468	GTH11569.exe
2468	GTH11569.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\munff1.dll	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\munff1.dll	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\comres.dll	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\GTH11569.exe	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fOnTS\comres1.ttf	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
File created	C:\Windows\fOnTS\GTH11569.TTF	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
File created	C:\Windows\fOnTS\GTH11569.foN	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTH11569.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
2468	GTH11569.exe
2468	GTH11569.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2468	GTH11569.exe
2468	GTH11569.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2468	2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2468	2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2468	2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2468	2364	eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\GTH11569.exe
  C:\Windows\system32\GTH11569.exe C:\Windows\fOnTS\comres1.ttf dns C:\Users\Admin\AppData\Local\Temp\eeaf1e8284f9062603d46bc7d6d3eb52_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\GTH11569.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Windows\fOnTS\comres1.ttf

Filesize
11KB

MD5
c6aadd399e186d57b5023369eafe4351

SHA1
bad9886c76ecefd5d3108b2ad78e503802b916c7

SHA256
dab2ffb594963ab538b5750822c174114615b6c810d41c06f6a55cbc8cff0a83

SHA512
e60a28ed6de4435ab5e7a303c5f02d5caee9b152a3d972e05943e247567c828616912885528e1ba8d9a162fc889c36c8eed39f0253edd3163d73f007c2c08771

Download Submit
C:\Windows\fonts\GTH11569.TTF

Filesize
61KB

MD5
0fe98dde787663d7514a55a235fa5079

SHA1
a5aa372437a751d87e9a3a1eb7b118c57b19f228

SHA256
cbc7c42d25da3527f93fe1657ce9619fc51b508f4e5ac620b705f5b91b09a640

SHA512
074328b1f90d974e2d25b223cba038c514b02d5ab2c4452d354310fedc07a570036425507b14dccc7c3e721b362376279619e15cb8474c5ce79a2c2ca2acd558

Download Submit
C:\Windows\fonts\GTH11569.foN

Filesize
1KB

MD5
399e95ec6a93d0a2135de65cb023307c

SHA1
1a4fc5da65c4239a7b850444f8ebf9e80303a617

SHA256
2129dca6c610dd991316795ac8abc4e5dee510816d148ed9f428a19f743a30f6

SHA512
17bb72e6b7fc4bace49b175ad24cdb55df1c3b6265004417d3faeb719e7a5fba172d3e834a3e7c57df76b11fd1ab1ef787865b8e8960e43d8e88d424858c5450

Download Submit
\Windows\SysWOW64\munff1.dll

Filesize
40KB

MD5
84799328d87b3091a3bdd251e1ad31f9

SHA1
64dbbe8210049f4d762de22525a7fe4313bf99d0

SHA256
f85521215924388830dbb13580688db70b46af4c7d82d549d09086438f8d237b

SHA512
0a9401c9c687f0edca01258c7920596408934caa21e5392dbaefc222c5c021255a40ec7c114a805cdb7f5a6153ec9fa9592edcc9e45406ce5612aa4e3da6a2c4

Download Submit
memory/2468-14-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2468-18-0x0000000002520000-0x0000000006548000-memory.dmp

Filesize
64.2MB

Download
memory/2468-19-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing