d95f251484840efb74c8ebb7a2fbfc904be41ec62e64bdb125dd94dc5d7f5d55

General

Target
8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
Size 414KB
Sample241031-g6ps6ssfml
SHA256 d95f251484840efb74c8ebb7a2fbfc904be41ec62e64bdb125dd94dc5d7f5d55
MD5 8202ecd499a1ba153a22b74ecc1e2305
SHA1 e29955281d51bcf8066c130b816034ae404dd72a
SHA512 39450c403c7020b2f290068cd85d9d574ccf7daf6936add27699faa8be0641dad4180a593e15cbc5d45330e4c0399afcff23f316eb1cdfaa6f885481d19547ca
SSDEEP 12288:Xw4zKQsJeN9kUvInsw0HehUxX1yIxjvilZxuzQIo4N:XdzKGM0+SjyIpilZ40P4N
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ìÛ„wRÜ„w$.lnk	explorer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qSbErxizyZhBQpSBSRmiulIDux = "C:\\Windows\\system32\\ChCzNepjrNzkIc.exe"	explorer.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ChCzNepjrNzkIc.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\ChCzNepjrNzkIc.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe
1636	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
Token: SeDebugPrivilege	1636	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1636	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe	87
PID 3896 wrote to memory of 1636	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe	87
PID 3896 wrote to memory of 1636	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe	87
PID 1636 wrote to memory of 956	1636	explorer.exe	103
PID 1636 wrote to memory of 956	1636	explorer.exe	103
PID 1636 wrote to memory of 956	1636	explorer.exe	103
PID 3896 wrote to memory of 4968	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe	118
PID 3896 wrote to memory of 4968	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe	118
PID 3896 wrote to memory of 4968	3896	8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8202ecd499a1ba153a22b74ecc1e2305_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\akk897ccc30737.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8202EC~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968