e72cb54e5bc0b63b1bfef674412e6636c823a0ce352ba7fbaae98054e2fcfa6f

General

Target

f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe
Size

1.7MB
MD5

f0b8429cd58bffd298685c74c90100ac
SHA1

e1d94c9cbd483cc7d3cfe720ee4686bcb93a86a4
SHA256

e72cb54e5bc0b63b1bfef674412e6636c823a0ce352ba7fbaae98054e2fcfa6f
SHA512

389cb4e5c6ba58e2369ea1616559c8974b0280d69176493ca4c8a0b5604e8bcdeb8b6486dcefae6cade3ddf61da133754147e5ce1dc9ed4ff61629f534d81ff9
SSDEEP

49152:6UCC2brnCmsLTz2a8Y3CdMX0iPDmhIfeuyGuSq0GJyFaq:+fnDs7u+IMXZSyrLuSvGJycq

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2844	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe
2844	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp
2844	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp
2844	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2844	2112	f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\is-IKBLF.tmp\f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IKBLF.tmp\f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp" /SL5="$40108,1335443,121344,C:\Users\Admin\AppData\Local\Temp\f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-IKBLF.tmp\f0b8429cd58bffd298685c74c90100ac_JaffaCakes118.tmp

Filesize
1.1MB

MD5
34acc2bdb45a9c436181426828c4cb49

SHA1
5adaa1ac822e6128b8d4b59a54d19901880452ae

SHA256
9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

SHA512
134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

Download Submit
\Users\Admin\AppData\Local\Temp\is-JT536.tmp\OqIEFuprtaC.dll

Filesize
1.0MB

MD5
16090d48f4c90ffc959e878e7e697cbd

SHA1
dba2748e05b8b2c1f7d8fd7f9c677764a3365946

SHA256
e61ea546a518289762cb8ba240863f5c8f82b9c8de5d44281d1af3bc6c1104c6

SHA512
5679ecbf8fbb795660f225f5712aa16a6e26a34615cb7eb04e5a6ba1165fd10a775d9ae09871f83e2fb8f1628320187cb56ad62be6a4a8b8aae9227845375403

Download Submit
\Users\Admin\AppData\Local\Temp\is-JT536.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
\Users\Admin\AppData\Local\Temp\is-JT536.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
memory/2112-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2112-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2112-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2844-13-0x0000000004E50000-0x0000000004E8C000-memory.dmp

Filesize
240KB

Download
memory/2844-8-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2844-20-0x00000000054C0000-0x00000000055CE000-memory.dmp

Filesize
1.1MB

Download
memory/2844-28-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2844-27-0x00000000054C0000-0x00000000055CE000-memory.dmp

Filesize
1.1MB

Download
memory/2844-26-0x0000000004E50000-0x0000000004E8C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing