de4f294516925fc1369aea68162e7b840fa272295b86bfa13f658d5d561f7be5

General

Target

0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe
Size

558KB
MD5

0eab7d5bd9d992dd6ac1e3cc634d2bf1
SHA1

b3f8e7ebf75667c46cdf1a37d8329ac0654cb81c
SHA256

de4f294516925fc1369aea68162e7b840fa272295b86bfa13f658d5d561f7be5
SHA512

21387a9aee79e96902abb7348da03f380a81cd6e60e5f5e779e1c025f832798943c8f074c514fa1df538f388daa46a1867eb4ce09f4a90164a2972e6b1b4ef7d
SSDEEP

6144:jyH7xOc6H5c6HcT66vlmszvZJO3VRg948qxjF3k4F4T4KBYX+pd1bEz2s7ETRhE8:jaBvHO3gg7dX+pd167QhEUn7+ijXB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2140	svchost.exe
2840	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe
2728	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2140	svchost.exe
2140	svchost.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2140	2920	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2140	2920	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2140	2920	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2140	2920	0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe	31
PID 2140 wrote to memory of 2840	2140	svchost.exe	32
PID 2140 wrote to memory of 2840	2140	svchost.exe	32
PID 2140 wrote to memory of 2840	2140	svchost.exe	32
PID 2140 wrote to memory of 2840	2140	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2840

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0eab7d5bd9d992dd6ac1e3cc634d2bf1_JaffaCakes118.exe

Filesize
523KB

MD5
8dd7cd6b729f8c030f708c850d6e0248

SHA1
5a7a4ff330645e16d0ee57d6ce255b59fc1be6ef

SHA256
b2a42f0a1ec5c16626c0dcc0a6670d90a225bf6cccc7c3232ca14c63f6d5a0c8

SHA512
fae640f4fc088cd8553d39bc781dad408b0dc7e3e6c5f5cfe463b99f2c7a1e3492df82e54a3f49c5792ee12aa23321ac1e27583ef84289c0dd84a0d002634503

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
ff948cfa9e42bc40cd308ecef233f087

SHA1
c3272caf5613c96dc56a306e84fba4062a2d928e

SHA256
3638dc9b5a971f313387af6c212d07afa764dd8bdcec72e58b758e6954dc0847

SHA512
12e47a2c575de7ae6b0db827944ba3bb68fcbbbe59d9bc33f13e7d84a08f18f84ac98ee50d531ef1ec82e25eeb15f55bbb941f8ce4f61f24105037319c83d4df

Download Submit
memory/2140-18-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2728-21-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2728-33-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2920-5-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download

Analysis

Sharing