aa15d8286e696979b54a04b0498ed3ca9c5ffad2fc8c4286d17d2f244e6eccba

General

Target

ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
Size

1.9MB
MD5

ee5f38d898e0f203d5254ff4afdb603d
SHA1

6a727181a69a34cb89b287c1547430f26751c60a
SHA256

aa15d8286e696979b54a04b0498ed3ca9c5ffad2fc8c4286d17d2f244e6eccba
SHA512

4d21267e4f5304d71e1674f54f9ad19032405b68f3bba68d670f4dba13be4f983b8431acdc351294e4e6ec18691ee8002ed1bc63d89d47eb5d13d2074c393851
SSDEEP

49152:tLFaExeWMLFd2yIO/05OvPsvylyJW58cnnZURRuEuAqP+ysFlzQ7:pcEx9i2yIw1vP5yYvkuEu9P+VTz

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

wscript.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WTeEqNLdqe.url	wscript.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3116	3468	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

wscript.exeee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe

pid	Process
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.execmd.exe

description	pid	Process	procid_target
PID 3468 wrote to memory of 5004	3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe	91
PID 3468 wrote to memory of 5004	3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe	91
PID 3468 wrote to memory of 5004	3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe	91
PID 5004 wrote to memory of 4164	5004	cmd.exe	93
PID 5004 wrote to memory of 4164	5004	cmd.exe	93
PID 5004 wrote to memory of 4164	5004	cmd.exe	93
PID 3468 wrote to memory of 2784	3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe	94
PID 3468 wrote to memory of 2784	3468	ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee5f38d898e0f203d5254ff4afdb603d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C WScript "C:\ProgramData\nEzJvZquBf\r.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\wscript.exe
    WScript "C:\ProgramData\nEzJvZquBf\r.vbs"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    PID:4164
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\ProgramData\nEzJvZquBf\cfgi"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1204
  2⤵
  - Program crash
  PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3468 -ip 3468
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nEzJvZquBf\r.vbs

Filesize
660B

MD5
d409859af56603061a0b72e8f6535b79

SHA1
3d705a45d05e537f589c863440dbe60b1e5063b3

SHA256
29999515e6085335d6cfbec789387c36559c16a8675e5f1882fb28618ed6d794

SHA512
6754721373e400dcb3b3ce75fe7b6d67a4a077f6416efcf9c358b56f5eb9c2d40a0b59b1d8e4c173bff5a5ec9924a84c2fd3629fdbb6bca437f2763cea74b752

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WTeEqNLdqe.url

Filesize
73B

MD5
2d8b5417b1f66ae3a1f63884d9c487ff

SHA1
81e8455bb9150180f9846f3c445e695d06bd7463

SHA256
7cc41e8d2a8ff132f72cbfd0cc8a5bc904fe9ec217f95e61d31d63ce342abf20

SHA512
2adc356d1bf6050786276b3032f7ba1bc64150f36f6ae7fa6913a1f11322840d57dd649ec315d02238049c86d31d0e6b523fe07678b86743522cd2b6c08bab46

Download Submit
memory/3468-1-0x0000000002710000-0x00000000028D1000-memory.dmp

Filesize
1.8MB

Download
memory/3468-2-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/3468-3-0x0000000002710000-0x00000000028D1000-memory.dmp

Filesize
1.8MB

Download
memory/3468-4-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/3468-5-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/3468-19-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/3468-18-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads