6fb0c80e2deb0673b360d5680e8fe03d306975dbf128d722beba3393b0d9c00e

General

Target

3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe
Size

953KB
MD5

3d086bd6f3e40105c550a13f0de8b1bc
SHA1

f9ac8e754e569eb672024ef953aee0d69a0be6e8
SHA256

6fb0c80e2deb0673b360d5680e8fe03d306975dbf128d722beba3393b0d9c00e
SHA512

4406d1659827cf1271b618167e712743b78162d0f2d237eb0ae2b5a17d83760621420de946e0623fab4830b8c21f85b400d02266672d20ae7bdc6346f109903c
SSDEEP

24576:OFWDhenrDQIn1Nc9YBnjaRdco4s0oOH8OgBPVnOA8dOkQ:pNen4uNc9injaRbco+XgNcOT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2140	DomaIQ10.exe

Loads dropped DLL 1 IoCs

pid	Process
2692	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2140	DomaIQ10.exe
2140	DomaIQ10.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2140	2692	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe	28
PID 2692 wrote to memory of 2140	2692	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe	28
PID 2692 wrote to memory of 2140	2692	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe	28
PID 2692 wrote to memory of 2140	2692	3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\DomaIQ10.exe
  C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\DomaIQ10.exe /path="C:\Users\Admin\AppData\Local\Temp\3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\config.dll

Filesize
32B

MD5
2988cf9b20f7ece761add45dde23e189

SHA1
6d7f25bc811414434961079fc58eaf30c71e6013

SHA256
216b6f4f5dfd5f867154fdeb6a70d410052acbc2512f95cde4d94fb54caba2b4

SHA512
a7bbb2c110fa0e42310dd015a81e276216943c54976be7bbd8fd50e31c4c04e990afa18cb8b72da42c8ced90692821d803407d4d6b7b1f76d1285e581ef12ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\routes.dll

Filesize
257B

MD5
8fc132d017671cb9f0322ef97411aed7

SHA1
ec7587f1ce58736442912f1152fcc76c735eb26c

SHA256
a5d0ce7bd7d4c43cb49c2a76ceef62fe78733c22ad6132da73a871f29aeb5280

SHA512
2d5145b253ca05f3b28bb35dac53611cb7513b0502f01307cd47e592789abe85f68e6c8a312e5b319a34a0e10be6fb60b42cbf0b6084c43a07fdb96196192d37

Download Submit
\Users\Admin\AppData\Local\Temp\Doma\VAFPlayer_087\DomaIQ10.exe

Filesize
337KB

MD5
837cd0fdd95a97e37b8c86b0b5adaa03

SHA1
ec2904bfd56f83def5e9ee22cfa09c12bd8a86f7

SHA256
a4fad1d2e99847aa829464e3d6447bff305f6fa9c6eaa82954b320ac79c8030f

SHA512
13e20b79dfb95a6920cf0be15a0f1b139b4154df965a4c700defaac21d8fb407938775fc10053dc61411284f835171d1ee9bc41060207a98fdaedbf341599a7b

Download Submit
memory/2140-18-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-20-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-13-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-14-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-15-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-16-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-17-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-11-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-19-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-12-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-10-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/2140-9-0x000007FEF58EE000-0x000007FEF58EF000-memory.dmp

Filesize
4KB

Download
memory/2140-23-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-24-0x000007FEF58EE000-0x000007FEF58EF000-memory.dmp

Filesize
4KB

Download
memory/2140-25-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-26-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2140-28-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing