2036a52495fdcf39007764c01dc6da76f5a6ecd5388c034b08ba37ab41438200

General

Target

fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe
Size

584KB
MD5

fdada3630a5239e45c6201c491f59e77
SHA1

08c782fffe206b35d5d075b1c347508fb3823bde
SHA256

2036a52495fdcf39007764c01dc6da76f5a6ecd5388c034b08ba37ab41438200
SHA512

e77f8081fd9007a675827a10d098d32fdb901826f345bc8e883e65d1a9f1b0a3774799e11ebd7974213793d1906e89a6d0516519cd57aa421ea79a46baa71884
SSDEEP

12288:+IoaM3LIgh3wLfoLJ7hIzdCMQM3hc1c2obY7l2ChK82qvViq:+htwLgLJdIzd+dochLI8/vViq

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\skynet.exe	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\skynet.exe	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2108	2244	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe	89
PID 2244 wrote to memory of 2108	2244	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe	89
PID 2244 wrote to memory of 2108	2244	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe	89
PID 2244 wrote to memory of 1856	2244	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe	90
PID 2244 wrote to memory of 1856	2244	fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdada3630a5239e45c6201c491f59e77_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4668,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat

Filesize
218B

MD5
ee4821f62974f32b68ac159cf880b64f

SHA1
65086e3bb3d22588b4936ab495dd37675bab5462

SHA256
4dc2a1a37e7f4c828d0d1d1575f431a8999101ec4be488266e3e89e712fa6b5c

SHA512
0d9d645e0e88927911d2afa20d25fde8e2538ffafaeb8b19ccdcf8c9658f5580252414262efff842ea37693f22583c5b0cf679ab2b074ee7a7e949ee230e2270

Download Submit
memory/2244-5-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2244-11-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/2244-3-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2244-10-0x0000000002D50000-0x0000000002D53000-memory.dmp

Filesize
12KB

Download
memory/2244-9-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2244-8-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2244-7-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2244-12-0x0000000002D40000-0x0000000002D46000-memory.dmp

Filesize
24KB

Download
memory/2244-15-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/2244-0-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2244-26-0x00000000022C0000-0x0000000002310000-memory.dmp

Filesize
320KB

Download
memory/2244-2-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2244-6-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2244-17-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2244-16-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/2244-14-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2244-13-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/2244-23-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/2244-22-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/2244-24-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2244-1-0x00000000022C0000-0x0000000002310000-memory.dmp

Filesize
320KB

Download
memory/2244-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing