ff36f6f516121a9ac12534791f47528e5958ce0bde68c03b604779bce7fcca88

General

Target

009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe
Size

132KB
MD5

009d0f4eba5c4d0eb1125c87f3b0115b
SHA1

92389180df1325d1d1bc625ffd7ce98ee649b8b7
SHA256

ff36f6f516121a9ac12534791f47528e5958ce0bde68c03b604779bce7fcca88
SHA512

327e67ff1d4ab0cff75ad863c8f1f876dd84236e11fbe8af876169b1cc337780cdbc31f57b6ba474d973d709503d830c7e5fff58ca32cc3cc7c45ee5b3bd2dc8
SSDEEP

3072:DbhlKctmP7zFHt0Gk8VXcANmF6uGmK8nN3:DbKDzdtw2XPNmN/K8N3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3264	taskhost.exe
1296	taskhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\taskhost.exe"	taskhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 5032	4996	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	82
PID 3264 set thread context of 1296	3264	taskhost.exe	87

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4500	4996	WerFault.exe	81
1704	3264	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 5032	4996	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	82
PID 4996 wrote to memory of 5032	4996	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	82
PID 4996 wrote to memory of 5032	4996	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	82
PID 4996 wrote to memory of 5032	4996	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	82
PID 4996 wrote to memory of 5032	4996	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	82
PID 5032 wrote to memory of 3264	5032	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3264	5032	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	85
PID 5032 wrote to memory of 3264	5032	009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe	85
PID 3264 wrote to memory of 1296	3264	taskhost.exe	87
PID 3264 wrote to memory of 1296	3264	taskhost.exe	87
PID 3264 wrote to memory of 1296	3264	taskhost.exe	87
PID 3264 wrote to memory of 1296	3264	taskhost.exe	87
PID 3264 wrote to memory of 1296	3264	taskhost.exe	87

C:\Users\Admin\AppData\Local\Temp\009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\009d0f4eba5c4d0eb1125c87f3b0115b_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 304
      4⤵
      Program crash
      PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 292
  2⤵
  - Program crash
  PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3264 -ip 3264
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\taskhost.exe

Filesize
132KB

MD5
804f41efa739814d91bb08e91ca15776

SHA1
f17c8684ab8f1b8c6287c2164c04f035ec889cb1

SHA256
a26c41041adba864b6b4a9f2066d225f5084fe3630a33c88602313bac2b4c5d9

SHA512
26b461b6a06f4db1ab005270f7b12f72fe55b95e813cab4bca66873d9bc1c51790fcb3e5b103d88e67e3d38d841e0c5a3d8c4d04d5f1dc31112ab2ebe0602f4d

Download Submit
memory/1296-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-15-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-21-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-19-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1296-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5032-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5032-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5032-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5032-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads