e89787e68e7716bd717bfdcb90283b07335597a2929ad8b7c90b90cf6e2336ed

General

Target

37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe
Size

201KB
MD5

37c8dbaa869cb0c5b3c167ec5dc081c5
SHA1

6f2f17536bf2925c42873abe762a1406d4e279f5
SHA256

e89787e68e7716bd717bfdcb90283b07335597a2929ad8b7c90b90cf6e2336ed
SHA512

9a77c1fac264147c10f24deeee8ad5f8c6e8156af2a56cf7a382399d23044ecaa56a8c6d28072fc3678431e5c0905b0b551f8b66c41e451543614604c76591ea
SSDEEP

3072:lTiVKFaifRW9sJMROt6mF5LlesbDMIPl5GVjd:lSKFHRlUOUmF5rIpFd

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2572	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{3A726FE6-904DA616-D62163F4-C1989DF1}	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{3A726FE6-904DA616-D62163F4-C1989DF1}\ = e553d6ceb8c9955b82bc7aa4e10c71a82e9717bf40e7b1f09164cea156beb118aebfc8a754a07f12d87d3cda193c4224dab3fd53594b860cff95a7818046605fe64751e006ec1ee8790f66888f52370ba08cc149c9123184ea9daaf9351ed279fc229b4543929c84fa729d55790ea68810ed775560b25994450cd2b6e4e04eb3b3261b2144b2c3146b3f4c5835c4adfdf6a5aef2a9d4510ec5d75ebf3918dac510beed66755ee2f993e18bbdab662bef6cf72bd02cc6d7604f890869512ace8d68f549522acbb393a3c4e442509d8f85a84d2e7649113685e1ee0668bfadd869c61230c5d91e85b92e59f702a0ad006a492bd6ab40d4037c14da0fc5a881322d1d1606316f524883c94b2d6c76351f5e384725804e25499eb2b8e3e1ab3db319ecbaea1a7205957e8dd929c18e51e8ce8f76d76fff08d86dc4aa70ea6a933583e2e375c452224ba2531db4461050888d8f6997160f81b7bd9066b471dc22c7456f7dc85aa943b59c9d3b39a4a2b292ebbc0b655492ff7d27da207c53e6cb9fccc78810c9ff2dd876842fcf48d7773f609897c60ffec8d9a9f9f5196ebee918d13b7164aa9f92873a005bd1c4b6425e5bb904259cfec599a13956dacffad764808f3897200fd3e80b88542a7d6dd9167ef127191f823832e31b244493ef7b371c608707600055cd3e4999ee7968611706409f8178ae1bd6c40fc0486e2f4848758962f59d923af2651d02466d2f694852af4bb7f41fbf7f0f9e2ff1f6d46dcd7f116b69c07d9970ce766b2539a0d40670a5cfacaff0b5579a134a97ab374d2c575d37958d41a932ee5b36842e92d702ff53e73c002593ce3b29e48a604c40cb43ab7cb399d47ef027134044e901320e1d29c6a9dfeec7a87fad67a950e947d2a034599c0205835eab39531a7c3b65a3bee467ae10a9b74d6fc977721025fd21264671a11652ff35589e3978e2231abc829855fdf259ad86959ffd0726400f03681c8fc5c841763a911bc6fce0642f0d680ae8d5173d00dabe822743604c0f2b68b48d60d5788ee7a81fd6070fc028024b7b8c64b4af6df78a5f15b88ea2a814d7bd4f996879ca662b6f34a89e1739b0269e1186b91fdef8b8d865bfce27b72f6fc857120083d3e34ca455e04ee268dbaffb575b40bc7fa4d8403b6d1c4ac5cbce2cc8cb708c580843294476bdd126f55f9e47c650febf19d886baf1e59d3dfa5ae4050c5eab473390d4737314547f4f98a8830efbb75bd04480d3eb3b2b640b73ece3d654f0315d117a7a1b5bfcfb645c4e3957de40f8fd9ed907fae0249dac45494d122a85cd6d2a69932ac4f3822c844bef2cf7091035899e6d462a7eb519a182a6454072ce2b97accfb6285e2b47ab70f4935004f053dd34456fe257bbb05b6abc55260eef49884ed6b7311016757161eeae08082b6974169d41f97aa2a58272e463e3045b9fc487bfaf67e84f100801c94252a54d8d56698fb2172a80acfb95dbc1c336eb1154b6731e5c3987262f51c8b6695e2a47eb50f38f9348346bd3148cb374eba394034cd4e98f89d76e70499916bdf1661551be06e651ce79095aee7dc9e6adfeeae7ecdff4472d80766821d21abb3bdbdc440493e14ca90976b5a1de6646f1a16db1e96daa6aac4d4bf6ccde48f92be5340163a274d4e1f24d25e99ecac7929fcb87d390f346eb8f7417a3f064592306ab30d4134c84e8dec9478dd0f6fe20a76b1ff438d01a48838953d104ca8334bbaea317e4702066ddb18521fea15852fecba78cef48284ad32dc4eaac350a926dc3f6c360eb33cb5c2cf9a919d2018a9eac46eb6e332924ce6329c352047351947a02a38b33f3aca4e8fcf41bdf7cc7e67fff98a7421fea386b5df4bae0dc5a85c39dbb855c4e79c9e289f4f69f100701d09abe04182c471730b01920fa6b23348c126a43eb54cbcef3171470731d24fa6f23a89caec756df81c735df9d787a9fe387ac2068bf95a74dbff5d8523cc5dbf1bb65e48232b2e3e5cb1db405e0ded2f8c5dccd476990b2889c3706a0ae7e89278970ede7ca2f32376da0d62a00cb476c400bad13354ca28b8474831d034654c13f32d8d541b22e1c1679711a66fbe0242743000451ddf646d03fbd27d950f97f1ae78500010d026a1d9586f20e5c297b0ee3a9444acd5395c4fe0f18e8038f6c37e860c9e3695b963cff19a73e6067a34034c3514b02d31dbc06a6b090dd3145a2c15a96fdce99177ef059993ef9d91a7dfb59a43ed0a735601e4579fedee6c6ff8127fdbfe558ce39d6a60eb0b766efbff727e0af3e8859b6021073cfac97d5707d6da6ca8f0bd7f43052593d3a665be17b7da41a223d53e67c2f65e882700c29970af014ac8df735efe2f793df3b381be13cd2dbba0422834b13cc74765f5f7838a7a03ffd9899ba429bc37bdba4840230d3d14cb5555e7e79a7e22f1d88fa90a3bb03633c84595cc23bfc9c66f8f19b514306c45f90b873679440732b2c94a8c2cd4569be96a67e7fe698413dc25aec3d4a5af5bb6de316637f74d81f0787d0e0764a2f8b686bf70c6feb48cbf094117c02e7b2ffeba78b708cd1568eb16869b5322ded96e9be76999f058742402357c47f3fd89838c722bffba72390a440fcde9b79fbe224ac1da9faa9e50ddd89796a59f33ee3d9c47ac0230e13d744cfb3a89c0cf84b5cd4bb0ea3081b97bc4fa6777ee0a736dfefb877a620800b33ecdc15c4f24d5256fd0f99887a54a5317eda19c485b3e21372c4ea92d3347b2ddc56b9fe65276110c243fa9ca2842d230a8c139483cfec178a40b521517e8ea748d0d28a8b8cf397147f03e79b90fcf26423e03ca55b9dfc46e4dfad47f510edff16e7b140156f3e48279790ff0a98f5be61e636f1df1d3846e10f6d37d6608ebd96a6f1002db3caa3d2b4f45e63f89ca7ba8f5b4884abe34ccb35149d4dc6d590ceb368abb30be4ccf0d62fb0481f2ff848e49791ff0d9829c03235dd1245fb021c657b8e1c68052ff28854753d5e26c72f0068c753b0bc182441a116d1c1f54a1e0df9eaa22cdab405110e3269ed8ad6edfe69666a60151b8284a25f8a38f59cedf92aa18d4a15ab7e1427bd606555e242a25c9a87fd6f250832ab5374bc23dadc8506fdf1e5591efac79bc07bfca418708121d9be8698f0861b2f7ce8e4f02f5168b677a0904b3274936e8b974b4f8c680a0f73976cb057944fc0c815c8c2caf5ead1733164da31bce2db027b53db4cbcc89a6f7dc8daf6ba60a3a753dfc3f8645cfdf9d99a41829ab2fc65e5e20d7ca925762e1f69b8ae5a487c711926c68e1fd7b8bf1e58f9b959de79c65e7e87e7d08f489755b03e2ea777ef20a8234ed4c940913fb158e2ffc2672d004a290bf2341c2fc5b75de0faa25a6b3dcc5a958381bb91dc7e06d9614536cd61f666505ff747a0e056da8fc2173db0669c217b4664811dd9ba41a4b2d19c05f94e61094e0dc86a6f4dc8aaf02a68b3afe4d7f280d256c4ff5fa7b860678920568801f7a16fd2d78c80a982495b9684307fdd18baffe2271d8f0668ae35379e20b8d99efa47a290ed3835e721bff6d8103e43e714ef03880c1095737e1c2707c03ffc98643c7cdb65bc6226d3e10cad374ad04bfd0cd9957d4d9a554202f4fd9d1a85	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{3A726FE6-904DA616-D62163F4-C1989DF1}\ = 1f779ddfb8c9955b82bc7aa4e10c71a82e9717bf40e7b1f09164cea156beb118aebfc8a754a07f12d87d3cda193c4224dab3fd53594b860cff95a7818046605fe64751e006ec1ee8790f66888f52370ba08cc149c9123184ea9daaf9351ed279fc229b4543929c84fa729d55790ea68810ed775560b25994450cd2b6e4e04eb3b3261b2144b2c3146b3f4c5835c4adfdf6a5aef2a9d4510ec5d75ebf3918dac517beed66755ee2f993e18bbdab662bef6cf72bd02cc6d7604f890869512ace8d68f549522acbb393a3c4e442509d8f85a84d2e7649113685e1ee0668bfadd869c61230c5d91e85b92e59f702a0ad006a492bd6ab40d4037c14da0fc5a881322d1d1606316f524883c94b2d6c76351f5e384725804e25499eb2b8e3e1ab3db319ecbaea1a7205957e8dd929c18e51e8ce8f76d76fff08d86dc4aa70ea6a933583e2e375c452224ba2531db4461050888d8f6997160f81b7bd9066b471dc22c7456f7dc85aa943b59c9d3b39a4a2b292ebbc0b655492ff7d27da207c53e6cb9fccc78810c9ff2dd876842fcf48d7773f609897c60ffec8d9a9f9f5196ebee918d13b7164aa9f92873a005bd1c4b6425e5bb904259cfec599a13956dacffad764808f3897200fd3e80b88542a7d6dd9167ef127191f823832e31b244493ef7b371c608707600055cd3e4999ee7968611706409f8178ae1bd6c40fc0486e2f4848758962f59d923af2651d02466d2f694852af4bb7f41fdfde029e2ff1f6d46dcd7f116b69c07d9970ce766b2539a0d40670a5cfacaff0b5579a134a97ab374d2c575d37958d41a932ee5b36842e92d702ff53e73c002593ce3b29e48a604c40cb43ab7cb399d47ef027134044e901320e1d29c6a9dfeec7a87fad67a950e947d2a034599c0205835eab39531a7c3b65a3bee467ae10a9b74d6fc977721025fd21264671a11652ff35589e3978e2231abc829855fdf259ad86959ffd0726400f03681c8fc5c841763a911bc6fce0642f0d680ae8d5173d00dabe822743604c0f2b68b48d60d5788ee7a81fd6070fc028024b7b8c64b4af6df78a5f15b88ea2a814d7bd4f996879ca662b6f34a89e1739b0269e1186b91fdef8b8d865bfce27b72f6fc857120083d3e34ca455e04ee268dbaffb575b40bc7fa4d8403b6d1c4ac5cbce2cc8cb708c580843294476bdd126f55f9e47c650febf19d886baf1e59d3dfa5ae4050c5eab473390d4737314547f4f98a8830efbb75bd04480d3eb3b2b640b73ece3d654f0315d117a7a1b5bfcfb645c4e3957de40f8fd9ed907fae0249dac45494d122a85cd6d2a69932ac4f3822c844bef2cf7091035899e6d462a7eb519a182a6454072ce2b97accfb6285e2b47ab70f4935004f053dd34456fe257bbb05b6abc55260eef49884ed6b7311016757161eeae08082b6974169d41f97aa2a58272e463e3045b9fc487bfaf67e84f100801c94252a54d8d56698fb2172a80acfb95dbc1c336eb1154b6731e5c3987262f51c8b6695e2a47eb50f38f9348346bd3148cb374eba394034cd4e98f89d76e70499916bdf1661551be06e651ce79095aee7dc9e6adfeeae7ecdff4472d80766821d21abb3bdbdc440493e14ca90976b5a1de6646f1a16db1e96daa6aac4d4bf6ccde48f92be5340163a274d4e1f24d25e99ecac7929fcb87d390f346eb8f7417a3f064592306ab30d4134c84e8dec9478dd0f6fe20a76b1ff438d01a48838953d104ca8334bbaea317e4702066ddb18521fea15852fecba78cef48284ad32dc4eaac350a926dc3f6c360eb33cb5c2cf9a919d2018a9eac46eb6e332924ce6329c352047351947a02a38b33f3aca4e8fcf41bdf7cc7e67fff98a7421fea386b5df4bae0dc5a85c39dbb855c4e79c9e289f4f69f100701d09abe04182c471730b01920fa6b23348c126a43eb54cbcef3171470731d24fa6f23a89caec756df81c735df9d787a9fe387ac2068bf95a74dbff5d8523cc5dbf1bb65e48232b2e3e5cb1db405e0ded2f8c5dccd476990b2889c3706a0ae7e89278970ede7ca2f32376da0d62a00cb476c400bad13354ca28b8474831d034654c13f32d8d541b22e1c1679711a66fbe0242743000451ddf646d03fbd27d950f97f1ae78500010d026a1d9586f20e5c297b0ee3a9444acd5395c4fe0f18e8038f6c37e860c9e3695b963cff19a73e6067a34034c3514b02d31dbc06a6b090dd3145a2c15a96fdce99177ef059993ef9d91a7dfb59a43ed0a735601e4579fedee6c6ff8127fdbfe558ce39d6a60eb0b766efbff727e0af3e8859b6021073cfac97d5707d6da6ca8f0bd7f43052593d3a665be17b7da41a223d53e67c2f65e882700c29970af014ac8df735efe2f793df3b381be13cd2dbba0422834b13cc74765f5f7838a7a03ffd9899ba429bc37bdba4840230d3d14cb5555e7e79a7e22f1d88fa90a3bb03633c84595cc23bfc9c66f8f19b514306c45f90b873679440732b2c94a8c2cd4569be96a67e7fe698413dc25aec3d4a5af5bb6de316637f74d81f0787d0e0764a2f8b686bf70c6feb48cbf094117c02e7b2ffeba78b708cd1568eb16869b5322ded96e9be76999f058742402357c47f3fd89838c722bffba72390a440fcde9b79fbe224ac1da9faa9e50ddd89796a59f33ee3d9c47ac0230e13d744cfb3a89c0cf84b5cd4bb0ea3081b97bc4fa6777ee0a736dfefb877a620800b33ecdc15c4f24d5256fd0f99887a54a5317eda19c485b3e21372c4ea92d3347b2ddc56b9fe65276110c243fa9ca2842d230a8c139483cfec178a40b521517e8ea748d0d28a8b8cf397147f03e79b90fcf26423e03ca55b9dfc46e4dfad47f510edff16e7b140156f3e48279790ff0a98f5be61e636f1df1d3846e10f6d37d6608ebd96a6f1002db3caa3d2b4f45e63f89ca7ba8f5b4884abe34ccb35149d4dc6d590ceb368abb30be4ccf0d62fb0481f2ff848e49791ff0d9829c03235dd1245fb021c657b8e1c68052ff28854753d5e26c72f0068c753b0bc182441a116d1c1f54a1e0df9eaa22cdab405110e3269ed8ad6edfe69666a60151b8284a25f8a38f59cedf92aa18d4a15ab7e1427bd606555e242a25c9a87fd6f250832ab5374bc23dadc8506fdf1e5591efac79bc07bfca418708121d9be8698f0861b2f7ce8e4f02f5168b677a0904b3274936e8b974b4f8c680a0f73976cb057944fc0c815c8c2caf5ead1733164da31bce2db027b53db4cbcc89a6f7dc8daf6ba60a3a753dfc3f8645cfdf9d99a41829ab2fc65e5e20d7ca925762e1f69b8ae5a487c711926c68e1fd7b8bf1e58f9b959de79c65e7e87e7d08f489755b03e2ea777ef20a8234ed4c940913fb158e2ffc2672d004a290bf2341c2fc5b75de0faa25a6b3dcc5a958381bb91dc7e06d9614536cd61f666505ff747a0e056da8fc2173db0669c217b4664811dd9ba41a4b2d19c05f94e61094e0dc86a6f4dc8aaf02a68b3afe4d7f280d256c4ff5fa7b860678920568801f7a16fd2d78c80a982495b9684307fdd18baffe2271d8f0668ae35379e20b8d99efa47a290ed3835e721bff6d8103e43e714ef03880c1095737e1c2707c03ffc98643c7cdb65bc6226d3e10cad374ad04bfd0cd9957d4d9a554202f4fd9d1a85	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3032	2572	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe	31
PID 2572 wrote to memory of 3032	2572	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe	31
PID 2572 wrote to memory of 3032	2572	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe	31
PID 2572 wrote to memory of 3032	2572	37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37c8dbaa869cb0c5b3c167ec5dc081c5_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 452
  2⤵
  - Program crash
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
0403ae981ba2391da6b5d71d0c9217d8

SHA1
98b7e1f04cda8740ae6d0a80993be6da0f05e784

SHA256
39ae394d3ffebf348aac16ba518b9414f12b61ff6d5f399d355e82de0cc03e76

SHA512
7b60be45a1509eba45be60277de858d71ebacfc6ae8712dac43451a02bc6a85e48a0a412d7443cb7fd65e5e608a789e3f53bae460a8a09354c8c3cf7177a0d98

Download Submit
memory/2572-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2572-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing