fb37d5ebfbd5880f210faccb781d3028bdc3f6e6210ed9ca30bc4c2992848709

General

Target

c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe
Size

2.0MB
MD5

c92963fb730d7ca1edc4e93557f47cf2
SHA1

325a03579a3447816923921f6fafb5c0ed4b2baf
SHA256

fb37d5ebfbd5880f210faccb781d3028bdc3f6e6210ed9ca30bc4c2992848709
SHA512

04c89744571f2a3436fa426c399824d6745af8ce566d876c44333f106f3d7694019a5161f7686d3d82bee406c6c4efd8b31248f3f0b52ad582b0b703b6e8aba7
SSDEEP

49152:OFUcx88PWPOpX0SF9sXebreu5FEBJ1YpPjeWtyGc:O+K88uPCHjsumZCjZyGc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2528	963.tmp

Loads dropped DLL 1 IoCs

pid	Process
2364	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2708	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2528	963.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	WINWORD.EXE
2708	WINWORD.EXE
2708	WINWORD.EXE
2708	WINWORD.EXE
2708	WINWORD.EXE
2708	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2528	2364	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2528	2364	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2528	2364	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2528	2364	c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe	28
PID 2528 wrote to memory of 2708	2528	963.tmp	29
PID 2528 wrote to memory of 2708	2528	963.tmp	29
PID 2528 wrote to memory of 2708	2528	963.tmp	29
PID 2528 wrote to memory of 2708	2528	963.tmp	29

C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\963.tmp
  "C:\Users\Admin\AppData\Local\Temp\963.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.exe C8EBBCB488DDE21ED94CBE0F5B5A394EE4F8B5B1A4D30F84722EA4D9E3F2BB55191BDE64126AB3754A8AD40C9C5F073425BE49AF73D39CDC78BDC94FFB8AEB7D
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.docx"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c92963fb730d7ca1edc4e93557f47cf2_JaffaCakes118.docx

Filesize
19KB

MD5
4046ff080673cffac6529512b8d3bdbb

SHA1
d3cbc39065b7a55e995fa25397da2140bdac80c1

SHA256
f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680

SHA512
453f70730b7560e3d3e23ddfa0fe74e014753f8b34b45254c1c0cf5fec0546a2b8b109a4f9d096e91711b6d02cb383a7136c2cb7bd6600d0598acf7c90c25418

Download Submit
\Users\Admin\AppData\Local\Temp\963.tmp

Filesize
2.0MB

MD5
37f7135e2ac1f79a4806181f111e749e

SHA1
07ee6bc4dfd80501840a9667d0749f6bbfd626b3

SHA256
1a47c31518b998ae253b0419a4bb88d679ed957a3613cca96637d36998192cec

SHA512
00154445db89f7f0065f4b4f58e1c65de2381d11356d6d82c37358f429aa11d18730ef5694bebf6d8bb7c2e480d801dbc5baab0072f04937b4104d821fad0b04

Download Submit
memory/2364-0-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/2528-6-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/2708-9-0x000000002FD31000-0x000000002FD32000-memory.dmp

Filesize
4KB

Download
memory/2708-10-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2708-11-0x000000007152D000-0x0000000071538000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing