881a84c863574a2249325d0df45b9fdfdb690f6393a24335d692ae7f9af86d3c

General

Target

30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
Size

132KB
MD5

30d4ee75e28d173e66d22c82be8b3e38
SHA1

a00c3db0d3df37065126cf5b4906197536fded53
SHA256

881a84c863574a2249325d0df45b9fdfdb690f6393a24335d692ae7f9af86d3c
SHA512

98983269243d98f0b8bcee024395747e6a13c6d58cb5820ad3507838929a1e23fc90fb83780d504ab76e56f88cb40ac4d1d3c5ea8b45f46df7761934ddf6ef71
SSDEEP

3072:3aeNbX4Q9ctlmvN8wPRgj24BB8Kay+GSVlsit:q4bIRmF8l243apnF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2064	taskhost.exe
2460	taskhost.exe

Loads dropped DLL 3 IoCs

pid	Process
1640	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
1640	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
2064	taskhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe"	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 2064 set thread context of 2460	2064	taskhost.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1640	2420	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	30
PID 1640 wrote to memory of 2064	1640	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2064	1640	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2064	1640	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2064	1640	30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2460	2064	taskhost.exe	32
PID 2064 wrote to memory of 2460	2064	taskhost.exe	32
PID 2064 wrote to memory of 2460	2064	taskhost.exe	32
PID 2064 wrote to memory of 2460	2064	taskhost.exe	32
PID 2064 wrote to memory of 2460	2064	taskhost.exe	32
PID 2064 wrote to memory of 2460	2064	taskhost.exe	32

C:\Users\Admin\AppData\Local\Temp\30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\30d4ee75e28d173e66d22c82be8b3e38_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Roaming\taskhost.exe
    C:\Users\Admin\AppData\Roaming\taskhost.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Users\Admin\AppData\Roaming\taskhost.exe
      C:\Users\Admin\AppData\Roaming\taskhost.exe
      4⤵
      Executes dropped EXE
      PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\taskhost.exe

Filesize
132KB

MD5
88ded52ca30b590ec67f6f5c96c71354

SHA1
eb9ba67674f2ae61296255676c0e746c5f1c8545

SHA256
d63e90b70de446ee74af91a31b332366bddac000f2a9ef3408863b4ffb5b2756

SHA512
58492d91c0bc817fbaea670bc59aec274272bf81d0d7f9c0682151939a222aa60ef6e12d8d87f82ee1a39ee24091df62c3b2e4cd39629209e51ec46c22460aa7

Download Submit
memory/1640-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1640-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1640-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1640-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1640-27-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-29-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-30-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-31-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-32-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-33-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-35-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2460-37-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads