0d2b50c2c7dc2ee40d9d78c782f96f7215f2bb4d7e693bf908019c8776e3e3aa

General

Target

5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
Size

617KB
MD5

5485bba218c4e8626dfa1b7721b04f6e
SHA1

1be0fa558f1b25af8bce18c5b08baf45de4677ff
SHA256

0d2b50c2c7dc2ee40d9d78c782f96f7215f2bb4d7e693bf908019c8776e3e3aa
SHA512

5327142225908fa92ce706c677fe0baac7baf1b36dc448d2aed96714c3a15cd6a4915303cfcf14205b3e27058123cb348cffe3025ccf9085b80e200d63e30162
SSDEEP

12288:x0h/rbQ+X8+UiDLbRHahMUiUDEprVubzgTY4ig:x0h/rbQ+X8+UiDLbRHahMUtERVubUTYU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

pid	process
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2324 5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe"
  2⤵
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe"
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe"
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe"
  2⤵
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe"
  2⤵
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-0-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/2324-1-0x00000000003C0000-0x0000000000460000-memory.dmp

Filesize
640KB

Download
memory/2324-2-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-3-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/2324-4-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/2324-5-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-6-0x0000000005150000-0x00000000051B0000-memory.dmp

Filesize
384KB

Download
memory/2324-7-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2324-8-0x0000000004350000-0x000000000437E000-memory.dmp

Filesize
184KB

Download
memory/2324-9-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2324 wrote to memory of 2284	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2284	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2284	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2284	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 3020	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 3020	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 3020	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 3020	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2844	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2844	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2844	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2844	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2936	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2936	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2936	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 2936	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 1640	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 1640	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 1640	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe
PID 2324 wrote to memory of 1640	2324	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe	5485bba218c4e8626dfa1b7721b04f6e_JaffaCakes118.exe

Analysis

Sharing