c87ac5f7b9521a3355f60a0b526eac8aba93d41a32d1c16473ab4b5100bfc005

General

Target

26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe
Size

141KB
MD5

26ed75f24f23cb0d42ada6b200cf99ec
SHA1

71fe1d82dc721478dd4957c27df1c430fd2b7854
SHA256

c87ac5f7b9521a3355f60a0b526eac8aba93d41a32d1c16473ab4b5100bfc005
SHA512

069227b8b1a334ad1e48f20a40d615669c9d9228b7a3fcd01829c9a8d9256a73ed3fe95e5eaf3f24d750f0b0c5218e77a567aa1263f80bd9c02278d954a23fbf
SSDEEP

3072:ZGu9BlfzWIbXWm+w0Jz5iyhC33O+99/ABUC+BciLb1vQyoFYkTNiP4Oy1Ek:Z/0uodC33O29AqCQ14FjRiP4xl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2016	ppi.exe
1708	ppi.exe

Loads dropped DLL 5 IoCs

pid	Process
2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe
2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe
2016	ppi.exe
2016	ppi.exe
1708	ppi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1708	2016	ppi.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ppi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ppi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1708	ppi.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2016	2568	26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe	30
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31
PID 2016 wrote to memory of 1708	2016	ppi.exe	31

C:\Users\Admin\AppData\Local\Temp\26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26ed75f24f23cb0d42ada6b200cf99ec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ppi.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ppi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ppi.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ppi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\ppi.exe

Filesize
164KB

MD5
d31d600bbdc5a27f174252df5d3ccc01

SHA1
7a93cef8500d12c00678ee13e728036dd843cb35

SHA256
97770efd6a2c1ede7e8aabb53419380d2fa4221d9b1dace6c1c59a5203f15459

SHA512
63b40061a9ebb4cfbd2e580bf5d31eb08e5ed0cb1823b2aea7ae85b48e008db63e6831dd1c004ef8a593e83db7eced7486659e881a62611da1d6bf509941601b

Download Submit
memory/1708-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1708-24-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1708-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1708-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1708-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1708-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1708-34-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads