d53aedd9e385eece0a12a27a9516efe58ad333127804b094bb9f5080be639b72

General

Target

286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe
Size

2.5MB
MD5

286a756da973a2d5c93f6369f29b0123
SHA1

ca524b9b2a224bb5a8ee44c34a20cf7bfd480bb3
SHA256

d53aedd9e385eece0a12a27a9516efe58ad333127804b094bb9f5080be639b72
SHA512

a617778b70b86f9aa0e96812c7a3566be22cc62f1c41b7a53ae3eaf7d48e1c878bfe046e6e8d787988fbf4060a08a0212a59b14680c986952ffed91b1d43518a
SSDEEP

6144:dDFmzEqZmco9WeHIo72BsHES7UuB5KR8nsxsXUI7/DF/LKw49y9EdxLqmdBZS91a:JFmz5Z9oQeo4ZEta2sLjx/0yCxdUpBi

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2936	Disbelieving Corps.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Bidaily Synchronize Task[973b].job	286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\286a756da973a2d5c93f6369f29b0123_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1120

C:\Users\Admin\AppData\Roaming\Disbelieving Corps\Disbelieving Corps.exe
"C:\Users\Admin\AppData\Roaming\Disbelieving Corps\Disbelieving Corps.exe"
1⤵
- Executes dropped EXE
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Disbelieving Corps\Disbelieving Corps.exe

Filesize
63KB

MD5
78fe1f92c0bbb15b309b361f84acf86f

SHA1
b715ce2dfcbaf6e5882c6a87bac9b46a92473a29

SHA256
ef35c8578bcf06fac3a1de58f1dfee4ee0d51efffab627a91f66b0d85d47140b

SHA512
5986b64a0d7e722291610f01db4a80bae7d2a399e158bccb34e27c095d6eb1fe7588ff7448f635bab5ff93587cbc8c4541ad8cd8c0dcd11ec822c65ae40c3ccd

Download Submit
memory/1120-16-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1120-18-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1120-6-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1120-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1120-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1120-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1120-5-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1120-4-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1120-17-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1120-10-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download
memory/1120-11-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1120-12-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1120-13-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1120-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1120-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1120-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1120-3-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1120-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1120-19-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1120-20-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/1120-22-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1120-21-0x00000000006E0000-0x000000000070F000-memory.dmp

Filesize
188KB

Download
memory/1120-30-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1120-31-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1120-29-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1120-28-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1120-27-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/1120-26-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/1120-35-0x00000000007A0000-0x00000000007C6000-memory.dmp

Filesize
152KB

Download
memory/1120-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1120-43-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download
memory/1120-44-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing