4b69f88b0aa9157bab884cd8af64c315998d94ac6bcf875c4737e6fe35ba9be7

General

Target

f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe
Size

187KB
MD5

f5a56b83bc5e9ee0dd18d4685b9e1669
SHA1

3fe96db022d54472f92cc046981dbc2cd9cba49b
SHA256

4b69f88b0aa9157bab884cd8af64c315998d94ac6bcf875c4737e6fe35ba9be7
SHA512

4af93bef311980320689b831c5b423fe6be6f88503e29fca05764fb213b4156ee4215743bc487ea624811a3363015f526f2213fe2584a9cbe36b8753a60d1a35
SSDEEP

3072:Bd+QJz+sQsGs3gU6J/CW+1V2WGmRtC0VnZ3Nl8xHmAWL:Bd7aU6Jqf1VxG2C0VZ3Ncf8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2740	CZY.EXE
2988	CZY2008.EXE
2708	CZY.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2740 set thread context of 2708	2740	CZY.EXE	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CZY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CZY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CZY2008.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2740	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2740	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2740	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2740	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2988	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	31
PID 1884 wrote to memory of 2988	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	31
PID 1884 wrote to memory of 2988	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	31
PID 1884 wrote to memory of 2988	1884	f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32
PID 2740 wrote to memory of 2708	2740	CZY.EXE	32

C:\Users\Admin\AppData\Local\Temp\f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5a56b83bc5e9ee0dd18d4685b9e1669_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\CZY.EXE
  "C:\CZY.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\CZY.EXE
    "C:\CZY.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2708
- C:\CZY2008.EXE
  "C:\CZY2008.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\CZY.EXE

Filesize
80KB

MD5
0ced035763b99aa9a7db861d6054ed77

SHA1
f924c36203918d6f79698793431eb5ed5359d0b0

SHA256
ac390f581121cb3dac6660db000b7a28a954e7a54c215ffafbdad3372cd0e658

SHA512
f0fbc97ccc802b0d7e88255a88ae964f77d2bb6b9c3f151daf6f3cd7bcc0f0babf48d38c59e8ccb616b381c4257ee1ab817445aafe7cb18e90490515be95c864

Download Submit
C:\CZY2008.EXE

Filesize
34KB

MD5
a0507239adad53ba7d98b365eb27bd52

SHA1
7ccf3686de07b2332a81d303361525ec294851fb

SHA256
6b873f0ddaecfd02dfd44dd235e9261ae7de845160118aa41cbe1bf659a8291e

SHA512
44707623384be0d167e9abb717505a9e84603e568b85307d792d7f147e1189ef10ccd3711ca91e1b6dcbbb602d25696603b1e84faa62103949c62fc59cb8c304

Download Submit
memory/1884-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1884-1-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2708-19-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2708-35-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2708-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-29-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2708-27-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2708-21-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2708-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2740-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2988-23-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2988-26-0x0000000013140000-0x0000000013167000-memory.dmp

Filesize
156KB

Download
memory/2988-18-0x0000000013140000-0x0000000013167000-memory.dmp

Filesize
156KB

Download
memory/2988-38-0x0000000013140000-0x0000000013167000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing