f5e8da04f38c6403006e9e1f98dd567ea3956424bcfeddf6fd404602c69c7a97

General

Target

168943620b6188590b4722822e71cfd1_JaffaCakes118.exe
Size

20KB
MD5

168943620b6188590b4722822e71cfd1
SHA1

c34e31ef4d8ac2b5034ec7348e7dd277d01b37db
SHA256

f5e8da04f38c6403006e9e1f98dd567ea3956424bcfeddf6fd404602c69c7a97
SHA512

d32215484992b0771f48b008286bf89dd25ba66dedb6cb1946e39d3394fcd78266e0569b72b72e14a7155cf2285a672889c9c73c74ce16378d227ae3b7b53e40
SSDEEP

192:A1smtURopKLb2JlQJiLb5QGf7yD3pgLGA8pBaH1lJFw5qxLGCvU:EsLRopKHulQwLdZ2Vgy2H3JFjG

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3020	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2268	csrcs.exe

Loads dropped DLL 2 IoCs

pid	Process
3020	svchost.exe
3020	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrcs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrcs.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2268 set thread context of 2120	2268	csrcs.exe	33

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3020	2308	168943620b6188590b4722822e71cfd1_JaffaCakes118.exe	31
PID 3020 wrote to memory of 2268	3020	svchost.exe	32
PID 3020 wrote to memory of 2268	3020	svchost.exe	32
PID 3020 wrote to memory of 2268	3020	svchost.exe	32
PID 3020 wrote to memory of 2268	3020	svchost.exe	32
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33
PID 2268 wrote to memory of 2120	2268	csrcs.exe	33

C:\Users\Admin\AppData\Local\Temp\168943620b6188590b4722822e71cfd1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\168943620b6188590b4722822e71cfd1_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\csrcs.exe
    "C:\Users\Admin\AppData\Local\Temp\csrcs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\csrcs.exe

Filesize
20KB

MD5
168943620b6188590b4722822e71cfd1

SHA1
c34e31ef4d8ac2b5034ec7348e7dd277d01b37db

SHA256
f5e8da04f38c6403006e9e1f98dd567ea3956424bcfeddf6fd404602c69c7a97

SHA512
d32215484992b0771f48b008286bf89dd25ba66dedb6cb1946e39d3394fcd78266e0569b72b72e14a7155cf2285a672889c9c73c74ce16378d227ae3b7b53e40

Download Submit
memory/2120-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3020-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3020-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3020-13-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads