ae2e35b8ed4885ba3547af211974a3aff2b61255f2a941b8091d73be821d09e7

General

Target

127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
Size

777KB
MD5

127869faf0aeb94a4225f994811ea115
SHA1

ab19d35def1dee6019f9daadbd2a1f8f948f315f
SHA256

ae2e35b8ed4885ba3547af211974a3aff2b61255f2a941b8091d73be821d09e7
SHA512

9e775837dc03c98778d9afd4a6b7018c67a3299ff616b827134b51bdfa98766574445dc6922d5b27347298dcbe4ba1fbad7b4204617af2606c4060d2e2d47a4f
SSDEEP

12288:UCMgipoY0EYnqM/RuIWBe5P0VtniENNOlBWQ41bIF3Z4mxxpDqVTVOCfbQ:xZFFE8qM5uJZNCW1ZIQmXAVTzfbQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1780	3.exe

Loads dropped DLL 6 IoCs

pid	Process
2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
1780	3.exe
1768	WerFault.exe
1768	WerFault.exe
1768	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1768	1780	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 2276 wrote to memory of 1780	2276	127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe	28
PID 1780 wrote to memory of 1768	1780	3.exe	29
PID 1780 wrote to memory of 1768	1780	3.exe	29
PID 1780 wrote to memory of 1768	1780	3.exe	29
PID 1780 wrote to memory of 1768	1780	3.exe	29
PID 1780 wrote to memory of 1768	1780	3.exe	29
PID 1780 wrote to memory of 1768	1780	3.exe	29
PID 1780 wrote to memory of 1768	1780	3.exe	29

C:\Users\Admin\AppData\Local\Temp\127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\127869faf0aeb94a4225f994811ea115_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 264
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.exe

Filesize
422KB

MD5
05c9527aa44c25f998018d049475f8bc

SHA1
ad9ee4abcebe6450d9fc31c326269d82be4a3741

SHA256
162e86440bddb2405968bb5bf11f02cee794d6819bdaefc88ea611654405d230

SHA512
0aeedf43d2b6eae37a56bdf6a8a2cf58930d87111e54d8020fe69d287b388a02bbd7a3bcba8063da0ede8ff953e087ff3e918f4257272757a353c1bd3b8ba721

Download Submit
memory/1780-19-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/2276-0-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2276-3-0x000000000107B000-0x000000000107C000-memory.dmp

Filesize
4KB

Download
memory/2276-2-0x0000000000240000-0x0000000000294000-memory.dmp

Filesize
336KB

Download
memory/2276-1-0x0000000000170000-0x000000000023E000-memory.dmp

Filesize
824KB

Download
memory/2276-7-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2276-20-0x0000000001000000-0x00000000010CE000-memory.dmp

Filesize
824KB

Download
memory/2276-21-0x0000000000240000-0x0000000000294000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads