e84a475778f0e9fc7483a08291f257853d720ce02bbeed16b1203ee4502aeb30

General

Target

113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe
Size

1024KB
MD5

113ce9cc31e8d9664b890dcfb2642070
SHA1

aebaad7d53bc42840810079d39c331aa38d6001f
SHA256

e84a475778f0e9fc7483a08291f257853d720ce02bbeed16b1203ee4502aeb30
SHA512

30053648ff11f693ac0aea31ec554bbeb81b1792e72dfbfff2268a232ba6b8587d1b868685e261afd047140f683d50b2611cb829db478f2c8df6adc1eb2baa5b
SSDEEP

6144:nVQ56vGLl8oYD09UvQm2BqiQYCYdsGo1FDXyJJ5SUn6T4Fu+f4pwh8VmK+KKb:pvGLlkQ9+v2WJYda1JMS+u++VqKw

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsOsToGyons.exe	buran.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsOsToGyons.exe	buran.exe

Executes dropped EXE 1 IoCs

pid	Process
3932	buran.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	buran.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3296	PING.EXE
4224	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3296	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3932	buran.exe
3932	buran.exe
3932	buran.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3932	buran.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	buran.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3932	2588	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe	82
PID 2588 wrote to memory of 3932	2588	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe	82
PID 2588 wrote to memory of 3932	2588	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe	82
PID 2588 wrote to memory of 4224	2588	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe	83
PID 2588 wrote to memory of 4224	2588	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe	83
PID 2588 wrote to memory of 4224	2588	113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe	83
PID 3932 wrote to memory of 2080	3932	buran.exe	85
PID 3932 wrote to memory of 2080	3932	buran.exe	85
PID 4224 wrote to memory of 3296	4224	cmd.exe	86
PID 4224 wrote to memory of 3296	4224	cmd.exe	86
PID 4224 wrote to memory of 3296	4224	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\buran.exe
  "C:\Users\Admin\AppData\Local\Temp\buran.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 & copy /Y "C:\Users\Admin\AppData\Local\Temp\buran.exe" "C:\Users\Admin\AppData\Local\Temp\113ce9cc31e8d9664b890dcfb2642070_JaffaCakes118.exe" >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\buran.exe

Filesize
242KB

MD5
89f28547b2d9ef143a248871f3cdca3d

SHA1
3402763f0405a9d9fcaeae3b2249704069c7d23a

SHA256
dc44d44259ec5fb6492e2b01a1be8fc7bfa1d9dc44e1ff1a4633cc3913fdae1b

SHA512
e23940b7dee4e59e9198508d15f7064e541f5153ce1f26895d912ef004444487641bb21613b487caa75ad75cdf1a23778569c99658254495a1852786d89cd2d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads