498b82dbd62eae7f7ff96df0a7100e19106c0426baf955b58253084d385e6a3d

General

Target

eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe
Size

242KB
MD5

eeb9b594b6d3f796e1281a73112f94f3
SHA1

366a024a858c1bb7a6ef7355db0b9502041faeb7
SHA256

498b82dbd62eae7f7ff96df0a7100e19106c0426baf955b58253084d385e6a3d
SHA512

4916e396246258e2ea5b2cea231121f96a09f47a7e02deea80dd065e446a494325b3db665006cb76f9f7245d47e9b38ac646da4b0ffcef7f676f49332b3dedc6
SSDEEP

3072:4EF3ZSjeb6RAn4LzNDGfgIMfrHA1S7UQz063SFZHxZ8rMMyHx3m6:ZHbv4P5GibBwQz063aZfxzx3t

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	C3EC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4788	C3EC.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C3EC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2564	regedit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4788	1552	eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe	82
PID 1552 wrote to memory of 4788	1552	eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe	82
PID 1552 wrote to memory of 4788	1552	eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe	82
PID 4788 wrote to memory of 1016	4788	C3EC.tmp	83
PID 4788 wrote to memory of 1016	4788	C3EC.tmp	83
PID 4788 wrote to memory of 1016	4788	C3EC.tmp	83
PID 1016 wrote to memory of 2564	1016	cmd.exe	85
PID 1016 wrote to memory of 2564	1016	cmd.exe	85
PID 1016 wrote to memory of 2564	1016	cmd.exe	85
PID 4788 wrote to memory of 4512	4788	C3EC.tmp	86
PID 4788 wrote to memory of 4512	4788	C3EC.tmp	86
PID 4788 wrote to memory of 4512	4788	C3EC.tmp	86

C:\Users\Admin\AppData\Local\Temp\eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eeb9b594b6d3f796e1281a73112f94f3_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\C3EC.tmp
  C:\Users\Admin\AppData\Local\Temp\C3EC.tmp C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s Adobe\Uninstall.reg
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C3EC.tmp

Filesize
13KB

MD5
82c159501dd6261bba8b54fdabb522d2

SHA1
10fe99f3a74b46f0bd246e6afcb8887f27adef8d

SHA256
93955b94ff901c917a9b3cc05305051fff61521a30e9809949d5f9e92bcc1d8f

SHA512
d2cc0ace89fb46a2048f5d30b04635a02ac13563e8a1e1e3964f81144e41325b3dad1a4d68c3f799ed7d2905fdc96524754adb1d1ee034e6d751a91859c84309

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat

Filesize
43B

MD5
4aa64a8c96f1223b24281db8168c31e2

SHA1
586ae36e734423eda3f322692171f36e05524d23

SHA256
231c2f7ddb71cd7637abeef2e362f85136cf319b69dc37f8633bd1df2f09dddd

SHA512
dca478da910ce45bc51166e21d94770643693ab7a3fb3bdfb6ba0faffc4152bbd8a2523220916f2f55fbc59ee5240e53474749cf647c3dc17e13d8df63dc0fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat

Filesize
104B

MD5
1cef6297d797292817110fc5a917953c

SHA1
8db25f71e572d1f822c723180d8213f629b17516

SHA256
fa0b03bc4bf4a7aabeeb6262a4d9acd24e7e11688e6513862298de1abeed9bf5

SHA512
4279f31b5608353efb15c825a62d2fcc1e81d30f42cdcb7d0383b463f56a9018beec4b6aeef5bfbc2b9dca1dc07146dead1ac78391e6bd0d1647ca1a34edf687

Download Submit
memory/1552-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1552-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4788-5-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4788-13-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing