4153ef4d808ef701a408ac91ff853336c21947b0581b0804de933b53cc74e990

General

Target

e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
Size

199KB
MD5

e5c902dd91723242bdf7afdadc5888e7
SHA1

e27102cf367e6439be73349f27f8b23278f0b9a0
SHA256

4153ef4d808ef701a408ac91ff853336c21947b0581b0804de933b53cc74e990
SHA512

487f3646cad76e3f863d78b4d6f2cd7c382f2d9dc75eaadfcafb44739a43b09f6dee1b493476f4c76b32733cd3c4795709c5ab70ca2a4a9e422ad2bdd4ff5665
SSDEEP

6144:StMhbwpYm+Piiz5XTPAzdelUOoptq+ZbcnqWS9:RxwMiizxTPAzEUxbB

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

Processes:

e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exerundll32.execmd.exe

pid process

1420 e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
3152
1160 rundll32.exe
932 cmd.exe

pid	process
1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
3152
1160	rundll32.exe
932	cmd.exe

Drops file in System32 directory 2 IoCs

Processes:

e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\iexpeSrv.dll	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\iexpeSrv64.dll	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3948 932 WerFault.exe cmd.exe
4536 932 WerFault.exe cmd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

pid process

1420 e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
1420 e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

pid	pid_target	process	target process
3948	932	WerFault.exe	cmd.exe
4536	932	WerFault.exe	cmd.exe

pid	process
1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe

description	pid	process	target process
PID 1420 wrote to memory of 1160	1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe	rundll32.exe
PID 1420 wrote to memory of 1160	1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe	rundll32.exe
PID 1420 wrote to memory of 932	1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe	cmd.exe
PID 1420 wrote to memory of 932	1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe	cmd.exe
PID 1420 wrote to memory of 932	1420	e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

4636 attrib.exe

pid	process
4636	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\iexpeSrv64.dll",CreateProcessNotify
2⤵
- Loads dropped DLL
PID:1160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240623312.bat" "C:\Users\Admin\AppData\Local\Temp\e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe""
2⤵
- Loads dropped DLL
PID:932

C:\Windows\SysWOW64\attrib.exe
attrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\e5c902dd91723242bdf7afdadc5888e7_JaffaCakes118.exe"
3⤵
- Views/modifies file attributes
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 524
3⤵
- Program crash
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 532
3⤵
- Program crash
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 932 -ip 932
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 932 -ip 932
1⤵
PID:4008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240623312.bat
Filesize
97B

MD5
d226a657b279c5fc0a892748230a56ff

SHA1
fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5

SHA256
9dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761

SHA512
07d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a

Download Submit
C:\Windows\SysWOW64\iexpeSrv.dll
Filesize
67KB

MD5
102547efba4b5723e5d7a346a2dcb5d1

SHA1
bff8386a3eaf4246dce5d8fd25f10969b571ea00

SHA256
ec5651e4482bdaee33ab48e99305b0747e3e06bc35b01791942dc8a073672002

SHA512
c2709556fcf32523d7e6e974ae71a04d64f2a3e8ff2e4d18c42d2890952f22ded273f03c75494b400f233aaa5971f748a91a9124e385a40592cb6caf4345d04b

Download Submit
C:\Windows\System32\iexpeSrv64.dll
Filesize
73KB

MD5
22c30629296f80f9b117335120a5d97a

SHA1
9eeef90297a72ea36b2390191f664eeaf141b31e

SHA256
f4288adc0f9074d7e472e7dd527e3fa56125fe702dd6b426e6959e316690a541

SHA512
6729d020c82f52220840088d16b07b3e7a38e7a5e6a566bee2a1596ab8e6ba6adf2e1a915daa33a4ecde5c8632fcc6b8bd7c7ae94a9b62e066ee14d2f5155103

Download Submit
memory/932-22-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/932-21-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1160-14-0x00000207C5920000-0x00000207C5921000-memory.dmp

Filesize
4KB

Download
memory/1420-9-0x0000000001000000-0x0000000001034000-memory.dmp

Filesize
208KB

Download
memory/1420-10-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1420-0-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1420-17-0x0000000001000000-0x0000000001034000-memory.dmp

Filesize
208KB

Download
memory/1420-7-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1420-6-0x0000000008AA0000-0x0000000008AA1000-memory.dmp

Filesize
4KB

Download
memory/1420-1-0x0000000001000000-0x0000000001034000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads