e9c11fed92f4e800f4d084a1d9d8283383d485f07c58dc60888dadc152c60af4

General

Target

08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
Size

260KB
MD5

08445b8d699b5da5c6bac58c054effcb
SHA1

acf7d7a9ad753809310a969dc52c09391d92038a
SHA256

e9c11fed92f4e800f4d084a1d9d8283383d485f07c58dc60888dadc152c60af4
SHA512

9a2cbf92ef2dcbafe83cc9cdeb307f01e6e5726f85c92bbedc50f9cdc1e4dea412d4606bb0717e809e2df11fb0c683fa1b366e83fa7afe77c486c27599a1dcbb
SSDEEP

6144:8hyZ/gWPXo/mcX7iISJf+kJqP1KmpQ+GftEptEz:sFEHMyJWe41K7+KB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1588	server.exe
4536	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1588	server.exe
1588	server.exe
1588	server.exe
1588	server.exe
4536	server.exe
4536	server.exe
4536	server.exe
4536	server.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 1588	3904	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	82
PID 3904 wrote to memory of 1588	3904	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	82
PID 3904 wrote to memory of 1588	3904	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	82
PID 1588 wrote to memory of 3388	1588	server.exe	55
PID 1588 wrote to memory of 3388	1588	server.exe	55
PID 1588 wrote to memory of 3388	1588	server.exe	55
PID 1588 wrote to memory of 3388	1588	server.exe	55
PID 3904 wrote to memory of 4536	3904	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	83
PID 3904 wrote to memory of 4536	3904	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	83
PID 3904 wrote to memory of 4536	3904	08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe	83
PID 4536 wrote to memory of 3388	4536	server.exe	55
PID 4536 wrote to memory of 3388	4536	server.exe	55
PID 4536 wrote to memory of 3388	4536	server.exe	55
PID 4536 wrote to memory of 3388	4536	server.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Users\Admin\AppData\Local\Temp\08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\08445b8d699b5da5c6bac58c054effcb_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1588
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
54KB

MD5
c15234d0aa3caa25c4012491176dbf4f

SHA1
b37a4c9bcd3ea73443487f462dcedbaea8bffdc9

SHA256
a16f83dfdc65db86da90b3f1fa773cf5ba77cccbc1dd402e9663f26981164fad

SHA512
d3526223ff7a7527caeec51a858b50164ec0d524dd6dbce5e206e4bdcdeae89f4ae8d3a2d7a25a57a010ef0e4b32f8f8f52be270f4fdcee78f97cee7cd238ae6

Download Submit
memory/1588-16-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1588-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1588-22-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1588-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3388-17-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3388-18-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3904-6-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-1-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-29-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-2-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-4-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-0-0x0000000001001000-0x0000000001003000-memory.dmp

Filesize
8KB

Download
memory/3904-9-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-3-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-5-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-15-0x0000000001000000-0x000000000107C000-memory.dmp

Filesize
496KB

Download
memory/3904-14-0x0000000001001000-0x0000000001003000-memory.dmp

Filesize
8KB

Download
memory/4536-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads