e9c11fed92f4e800f4d084a1d9d8283383d485f07c58dc60888dadc152c60af4

General

Target

08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
Size

260KB
MD5

08445b8d699b5da5c6bac58c054effcb
SHA1

acf7d7a9ad753809310a969dc52c09391d92038a
SHA256

e9c11fed92f4e800f4d084a1d9d8283383d485f07c58dc60888dadc152c60af4
SHA512

9a2cbf92ef2dcbafe83cc9cdeb307f01e6e5726f85c92bbedc50f9cdc1e4dea412d4606bb0717e809e2df11fb0c683fa1b366e83fa7afe77c486c27599a1dcbb
SSDEEP

6144:8hyZ/gWPXo/mcX7iISJf+kJqP1KmpQ+GftEptEz:sFEHMyJWe41K7+KB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2904	server.exe
2680	server.exe

Loads dropped DLL 6 IoCs

pid	Process
3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
2904	server.exe
3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
2680	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2904	server.exe
2904	server.exe
2680	server.exe
2680	server.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2904	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	30
PID 2904 wrote to memory of 1212	2904	server.exe	21
PID 2904 wrote to memory of 1212	2904	server.exe	21
PID 2904 wrote to memory of 1212	2904	server.exe	21
PID 2904 wrote to memory of 1212	2904	server.exe	21
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2680	3028	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	31
PID 2680 wrote to memory of 1212	2680	server.exe	21
PID 2680 wrote to memory of 1212	2680	server.exe	21
PID 2680 wrote to memory of 1212	2680	server.exe	21
PID 2680 wrote to memory of 1212	2680	server.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
54KB

MD5
c15234d0aa3caa25c4012491176dbf4f

SHA1
b37a4c9bcd3ea73443487f462dcedbaea8bffdc9

SHA256
a16f83dfdc65db86da90b3f1fa773cf5ba77cccbc1dd402e9663f26981164fad

SHA512
d3526223ff7a7527caeec51a858b50164ec0d524dd6dbce5e206e4bdcdeae89f4ae8d3a2d7a25a57a010ef0e4b32f8f8f52be270f4fdcee78f97cee7cd238ae6

Download Submit
memory/1212-25-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1212-21-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2680-52-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-24-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2904-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-18-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/3028-9-0x00000000005B0000-0x00000000005B9000-memory.dmp

Filesize
36KB

Download
memory/3028-1-0x0000000001001000-0x0000000001003000-memory.dmp

Filesize
8KB

Download
memory/3028-19-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3028-20-0x0000000001001000-0x0000000001003000-memory.dmp

Filesize
8KB

Download
memory/3028-2-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3028-0-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3028-3-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3028-5-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3028-38-0x00000000005B0000-0x00000000005B9000-memory.dmp

Filesize
36KB

Download
memory/3028-4-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3028-53-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads