dba4d76fb1d049ea4f4a3c447d9141489305594eef26f2e175b696ac620c59bf

General

Target

4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
Size

1.5MB
MD5

4077e3d5f9c40a972fbcc013991f324a
SHA1

6cc2be0cf870a3ab5fc92e73a66d48c12352a753
SHA256

dba4d76fb1d049ea4f4a3c447d9141489305594eef26f2e175b696ac620c59bf
SHA512

afd1431ebd8b93d9a4f29a95bdaa0c50a9a6e8daaf9961aa02ca7fce143a0fcead3c66c73575088f7501f430f07c6cbb3362f8b317996c313c0c68559d8897b9
SSDEEP

12288:v+q3bFCO9bHBa3AWZavABd0YItKOxZsSbWQdOm//8xLrQ6H+yy1Susr8MmH3j5Q:R19bHBiHj6cOxvbWQd9/EFMZLS5R0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2772	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2772	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2772	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2772	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	31
PID 2256 wrote to memory of 2656	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	32
PID 2256 wrote to memory of 2656	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	32
PID 2256 wrote to memory of 2656	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	32
PID 2256 wrote to memory of 2656	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	32
PID 2256 wrote to memory of 2716	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2716	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2716	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2716	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	33
PID 2256 wrote to memory of 2600	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2600	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2600	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2600	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	34
PID 2256 wrote to memory of 2596	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	35
PID 2256 wrote to memory of 2596	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	35
PID 2256 wrote to memory of 2596	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	35
PID 2256 wrote to memory of 2596	2256	4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe"
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe"
  2⤵
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe"
  2⤵
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4077e3d5f9c40a972fbcc013991f324a_JaffaCakes118.exe"
  2⤵
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/2256-1-0x00000000003F0000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2256-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2256-3-0x0000000000360000-0x000000000037E000-memory.dmp

Filesize
120KB

Download
memory/2256-4-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/2256-5-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2256-6-0x0000000005750000-0x00000000057EE000-memory.dmp

Filesize
632KB

Download
memory/2256-7-0x0000000004220000-0x000000000424E000-memory.dmp

Filesize
184KB

Download
memory/2256-8-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing