791d940bc16a7e5c542a9c3978d29a1318d14045aa95b63b2ae7bf304ef01e60

General

Target

JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe
Size

919KB
MD5

10fd51a2fddeefb093578f1a01650174
SHA1

02e4ab95d1c1dd0a02fa2f5d1df58cd4e56d184a
SHA256

791d940bc16a7e5c542a9c3978d29a1318d14045aa95b63b2ae7bf304ef01e60
SHA512

6d6991781f0a855eb32cf0fb5bbffd356a62c3fae547bd3c7f5f2fe8b52a68442c473e726d85ff8f0f5e3e7784969d8ffd3bdc814261778b89f289e7fa5cf20f
SSDEEP

24576:n4ABz1P24wvG1XhWConP+3j+sAMBY4N7CRl:nvh6vYOniAM+D

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2792	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
2792	cmd.exe
2792	cmd.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe
2192	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2716	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2484	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2484	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2548	JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe
2716	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2792	2548	JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe	30
PID 2548 wrote to memory of 2792	2548	JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe	30
PID 2548 wrote to memory of 2792	2548	JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe	30
PID 2548 wrote to memory of 2792	2548	JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe	30
PID 2792 wrote to memory of 2484	2792	cmd.exe	32
PID 2792 wrote to memory of 2484	2792	cmd.exe	32
PID 2792 wrote to memory of 2484	2792	cmd.exe	32
PID 2792 wrote to memory of 2484	2792	cmd.exe	32
PID 2792 wrote to memory of 2716	2792	cmd.exe	33
PID 2792 wrote to memory of 2716	2792	cmd.exe	33
PID 2792 wrote to memory of 2716	2792	cmd.exe	33
PID 2792 wrote to memory of 2716	2792	cmd.exe	33
PID 2716 wrote to memory of 2192	2716	svchost.exe	34
PID 2716 wrote to memory of 2192	2716	svchost.exe	34
PID 2716 wrote to memory of 2192	2716	svchost.exe	34
PID 2716 wrote to memory of 2192	2716	svchost.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_10fd51a2fddeefb093578f1a01650174.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Melt.bat" -s"
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\PING.EXE
    ping ; 1.2; 0.3; 0.4 - n; 1 - w; 500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 180
      4⤵
      Loads dropped DLL
      Program crash
      PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Melt.bat

Filesize
148B

MD5
7ca5feaabee8de6e3c7efb689f7be3d8

SHA1
885d525d5190b3965ca238b70f48b8d0dac289a1

SHA256
095276969d06b9478181089fc4ebaaba83baf18703b7e04a965aa0b6a962b896

SHA512
4b37b1154d47a8e7069ce4cc2a6957c15ae3de41461934335ad22f0fec5bcd9fc0f545f5a489b51d07a2cb5909a987b07c3380518427355fb44c720ded140b81

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
919KB

MD5
10fd51a2fddeefb093578f1a01650174

SHA1
02e4ab95d1c1dd0a02fa2f5d1df58cd4e56d184a

SHA256
791d940bc16a7e5c542a9c3978d29a1318d14045aa95b63b2ae7bf304ef01e60

SHA512
6d6991781f0a855eb32cf0fb5bbffd356a62c3fae547bd3c7f5f2fe8b52a68442c473e726d85ff8f0f5e3e7784969d8ffd3bdc814261778b89f289e7fa5cf20f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads