2d9e749f7e1cb56ce220ef2c180a0e025e84302159214355a760cee9064832ab

General

Target

410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe
Size

164KB
MD5

410ad9e6124a088783b636e030e343ec
SHA1

d3a5a38dac3b848d6bc17ae429e60125badcff0a
SHA256

2d9e749f7e1cb56ce220ef2c180a0e025e84302159214355a760cee9064832ab
SHA512

d28802661c45cecab57ff1819cceb624b252477b0a97726ee82e12439ee5174cef5afd806ecbcdd59c4270b3a99f847e0f3360c89d3f0c9ee6d1d01086879137
SSDEEP

3072:wiSVipBoNdGhm5P+0he9xagDexm6UJdme3HgrLpbPJG5hc:riilhmIQODDHBJdmOHIFs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2744	ins9123.exe

Loads dropped DLL 4 IoCs

pid	Process
2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe
2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe
2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe
2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ins9123.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	ins9123.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	ins9123.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	ins9123.exe
2744	ins9123.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2744	2860	410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\410ad9e6124a088783b636e030e343ec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\ins9123\ins9123.exe
  "C:\Users\Admin\AppData\Local\Temp\ins9123\ins9123.exe" ins.exe /e8428580 /u5193805b-c284-4f85-b972-26465bc06f2f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ins9123\ins9123.exe

Filesize
252KB

MD5
2b8fb03bf38cb33a98d804cfdc2bb2c0

SHA1
962a9850ff0728f80c14878859dc2307f6ab0ff2

SHA256
01053b858d8d24f62c5520fb0255d16e728d27d173c15d2d4082ffdf85adf5e8

SHA512
18b0d66a8152014d8e2ad03b8f1b80c69d9ebb805215735b476643fbd2fdb0e817b89f81beae604c969ad2b94225032f507e911c9874a735f2dfed32cf3925df

Download Submit
memory/2744-26-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-25-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-17-0x0000000074791000-0x0000000074792000-memory.dmp

Filesize
4KB

Download
memory/2744-18-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-19-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-20-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-29-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-23-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-21-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-28-0x0000000074790000-0x0000000074D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-22-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2860-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2860-24-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/2860-3-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/2860-31-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing