fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296

General

Target

JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
Size

700.0MB
MD5

f38d0053391ba2281f7483c4f14c0b58
SHA1

d793b55a9f3a1ace85465e2a7ceee44df337e4da
SHA256

fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296
SHA512

cfcb37ab14fce3a29c4a2dfa17982bce2dc42f87b3c0da2b72ebf85bea46f894337b5fe16dfdab017a19d028b73ae69709125b4fd8141e8642b5b9216a4f3dc6
SSDEEP

49152:VrXpRRs4Ws4XToj43MgVMHBZ6HpFe9SawpWryv1UAP31YbutJeHKoSlpfzDseKP7:oqs9ZxyhL78GYRsjVzsQxAOLV9FRKa4C

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3092	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	97
PID 1644 wrote to memory of 3092	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	97
PID 1644 wrote to memory of 3092	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	97
PID 1644 wrote to memory of 3592	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	98
PID 1644 wrote to memory of 3592	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	98
PID 1644 wrote to memory of 3592	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	98
PID 1644 wrote to memory of 3648	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	99
PID 1644 wrote to memory of 3648	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	99
PID 1644 wrote to memory of 3648	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	99
PID 1644 wrote to memory of 1688	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	100
PID 1644 wrote to memory of 1688	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	100
PID 1644 wrote to memory of 1688	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	100
PID 1644 wrote to memory of 756	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	101
PID 1644 wrote to memory of 756	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	101
PID 1644 wrote to memory of 756	1644	JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe	101

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
  "{path}"
  2⤵
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
  "{path}"
  2⤵
  PID:3592
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
  "{path}"
  2⤵
  PID:3648
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
  "{path}"
  2⤵
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fe1dbb3e8af7462232871fd159f3d633555f5313f8012db02e8abdcaffa1d296.exe
  "{path}"
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-0-0x000000007488E000-0x000000007488F000-memory.dmp

Filesize
4KB

Download
memory/1644-1-0x00000000001F0000-0x0000000000650000-memory.dmp

Filesize
4.4MB

Download
memory/1644-2-0x0000000005630000-0x0000000005BD4000-memory.dmp

Filesize
5.6MB

Download
memory/1644-3-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/1644-4-0x0000000074880000-0x0000000075030000-memory.dmp

Filesize
7.7MB

Download
memory/1644-5-0x0000000005040000-0x000000000504A000-memory.dmp

Filesize
40KB

Download
memory/1644-6-0x00000000053C0000-0x000000000545C000-memory.dmp

Filesize
624KB

Download
memory/1644-7-0x0000000008190000-0x000000000821A000-memory.dmp

Filesize
552KB

Download
memory/1644-8-0x0000000006170000-0x0000000006182000-memory.dmp

Filesize
72KB

Download
memory/1644-9-0x000000007488E000-0x000000007488F000-memory.dmp

Filesize
4KB

Download
memory/1644-10-0x0000000074880000-0x0000000075030000-memory.dmp

Filesize
7.7MB

Download
memory/1644-11-0x0000000008270000-0x00000000082D8000-memory.dmp

Filesize
416KB

Download
memory/1644-12-0x0000000008150000-0x0000000008164000-memory.dmp

Filesize
80KB

Download
memory/1644-14-0x0000000074880000-0x0000000075030000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing