df277746503e04884b24d9e0e07424edb214bceee2e9ae42cda8bdc5f50fe0d2

General

Target

f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe
Size

69KB
MD5

f6f48f41e0d62e16bbfdb5bc21d8a18a
SHA1

83162cde14f13db45ac67c8240c3915e234f2e43
SHA256

df277746503e04884b24d9e0e07424edb214bceee2e9ae42cda8bdc5f50fe0d2
SHA512

3b8d6916772ad9ddd0f5afb2d051c77963aae94c51503fc0a88be4db6647e15b22c1dcbfcc6db05f3f3daeb03fd3b41c7c2014e7c4e2d54b1eae5ab0d40c7cc2
SSDEEP

1536:BXhRDuZXcCvfA2p2nNWseT449eR8021ji:NhRDuZsufhp2UsZ49KGi

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30
PID 1724 wrote to memory of 25612	1724	f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f6f48f41e0d62e16bbfdb5bc21d8a18a_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:25612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-2-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-4-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-6-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-22-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-24-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-20-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-18-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-16-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-14-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-44-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-62-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-60-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-58-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-56-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-54-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-52-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-50-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-48-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-46-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-40-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-38-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-36-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-34-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-32-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-30-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-28-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1724-26-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/25612-7225-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/25612-7228-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing