6cfc3845bb6d44287fa57aaf53773df66a81c28c07c078c2cb0716d6045ffc63

General

Target

0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
Size

387KB
MD5

0596bcf08e3dbd5cab5f18a49f7080be
SHA1

af14f1c0394bd7a3da119da3a18799aa32a8e836
SHA256

6cfc3845bb6d44287fa57aaf53773df66a81c28c07c078c2cb0716d6045ffc63
SHA512

816906f5dfe74ed14256abb380685974a14eb24b1f1c5d992ee77789eff817a4b20c0f97bfec4ebed10f56ebb9c8378e022ad37c4e43e1fc6c2a5cd348e92a5c
SSDEEP

6144:MVeZmjW9FyRTBDeeqqjOLbqF/xijf0Oeo7Y0XoO1CH+XAgVmpnX2csU088TF9:vo69FIDehnKF8jfBxtoDH+QgoX2TNh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2088	setup.exe

Loads dropped DLL 7 IoCs

pid	Process
2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
2088	setup.exe
2088	setup.exe
2088	setup.exe
2088	setup.exe
2088	setup.exe
2088	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2088	2976	0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0596bcf08e3dbd5cab5f18a49f7080be_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\C468\setup.exe
  C:\Users\Admin\AppData\Local\Temp\C468\setup.exe 00010802
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C468\cdnins.dll

Filesize
84KB

MD5
3ae0ad5d8739fe943c62fa507c5ed977

SHA1
daf7e69cea771a21c5e9294dd03b04eb2cb8cd1a

SHA256
7791850ce7ec2d94ded3bd89b7b397cbcaddac35771bed4b9fc12d2742466c09

SHA512
3e778cecc59e25e5fe3ea86cc453e2a3afff40eab7aaf6e4f1a4e8abda801f912496051eaf2449a00fc9e148fafdc62193d69c02dada7e2bde6cb5cefe82e506

Download Submit
C:\Users\Admin\AppData\Local\Temp\C468\cdnprh.dll

Filesize
72KB

MD5
4152d00fe6e6fb2637f6207571a1eb63

SHA1
bd433d41d04711b76084e996c5dcb753100788e8

SHA256
37b8420ef45e7cd6c1426388411beb301a2b2e59d8e83a68d0fcf06e4d7df6a2

SHA512
ced579aa67009aa30fe0b54fc8a4fcd7f0aa3b8679e65f9fc52a7fa1f020e31f23fb8d579466ce1985b4ead02275f2b7af757a18f66bf7654fcb4d9abb2449de

Download Submit
C:\Users\Admin\AppData\Local\Temp\C468\setup.exe.Manifest

Filesize
586B

MD5
7461916cfd616d9b56018b513efea53f

SHA1
4c96ea610faeb1cdb13e5a71defab3d997a55047

SHA256
6287bb9826b10eb3b4e1accc133b70512b4e5be5fd9b50fbf41bc437d72f6c55

SHA512
86d84c6e6dac341212f2e118cbdf020d771287f8cbdcf7c1c76c3ba80a23cc657e93d552c435c59c55971aa1230996c9e8425327fbbd0da27526082bfdc96d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\C468\src.dat

Filesize
144B

MD5
84f9db21363fccb7bd760eec95492afc

SHA1
9672840deb2654cd91c2587b58d9e665af1bb2ed

SHA256
0f5b7426e74046d8c4f501274442f4830777b97547f95b96d857cab58b4fa7d9

SHA512
4d47f413ea13e402c7ba9feee8c9ecaea4e75a29968c8bb876752f02672a23739f5f702b8581fe6ef26d4251d606458db70b16d2b3ffb2f641b399008ee7d933

Download Submit
\Users\Admin\AppData\Local\Temp\C468\setup.exe

Filesize
28KB

MD5
b9d4e392e8ac6a4420f126cc88d8c0c1

SHA1
3fa9755060979a13973927906222a4929bb4c80f

SHA256
3d20d973651546be8d370ff9013bbdc03282808a212731b92852f0b789634064

SHA512
03fe62e90efaa0cf064c335d7dd4df912f738a85726eb77269687f398511b883400eb0b95d3a8158d2a5b7fec37e073bbde754a5b53e17732b18f667d9960128

Download Submit
memory/2976-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2976-2-0x00000000009C0000-0x0000000000B13000-memory.dmp

Filesize
1.3MB

Download
memory/2976-1-0x00000000009C0000-0x0000000000B13000-memory.dmp

Filesize
1.3MB

Download
memory/2976-38-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing