c84e5d24766fdb08f8b39e1c2d1d001f9bef1de3682e1da6e9db08cf29451d55

General

Target

460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
Size

1.2MB
MD5

460a32099725a7c4fefb1d79ca451059
SHA1

b91d1c7d6534aef4dc790768e1db95b6dc0977e4
SHA256

c84e5d24766fdb08f8b39e1c2d1d001f9bef1de3682e1da6e9db08cf29451d55
SHA512

f91075e3b78046501e448467e0a4bf8286e2706544b759c946019ba6a271726eaf41dc5a8452c51d61f531bb7e67483d05b621a0693c22f7631fb2380fba8e0d
SSDEEP

24576:ia/4gHHHigRqtVxdj8GZlWXiMgjFj7YT/1/H:zzHHHigQtVxdj8GbWXiMgjF7YTVH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2404	svchost.exe
740	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
2192	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2404	svchost.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
740	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
740	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
740	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2404	2124	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2404	2124	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2404	2124	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2404	2124	460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe	30
PID 2404 wrote to memory of 740	2404	svchost.exe	31
PID 2404 wrote to memory of 740	2404	svchost.exe	31
PID 2404 wrote to memory of 740	2404	svchost.exe	31
PID 2404 wrote to memory of 740	2404	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:740

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
\Users\Admin\AppData\Local\Temp\460a32099725a7c4fefb1d79ca451059_JaffaCakes118.exe

Filesize
1.1MB

MD5
4fd2c2fb6189095bc2ffd3da46979f0e

SHA1
b5984fb4531e8b86ecf083dd121032548638e1ed

SHA256
f9fd05fb589671d5f05139c8a771dad32d7f73c322d843bcc996eb6857dbc77f

SHA512
03092352899718532d922730592dc29fbd9b3c7ed09f3108be1e61db36e5db3d82cccebdcab56b40eadb7e61a298ba21074baee2c91de173acb8aa0e55b391b1

Download Submit
memory/2124-5-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2192-18-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2192-32-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2404-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing