e3b1d1f8ed6019d2e75ace44ea3de460a5707b39db65aec34891f48d623508e3

General

Target

fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
Size

29KB
MD5

fd1c1fc717004317f6e40b7d87be87c1
SHA1

aa89d7bcdca4afb9e814da28e2ca6ce2c582f622
SHA256

e3b1d1f8ed6019d2e75ace44ea3de460a5707b39db65aec34891f48d623508e3
SHA512

17fe13f1977734d7bc37aa7bcf5577bfaf727551163f2a0bb53a0c46f5054e9aa31b869c6ce9953d6702bebc0e414d487d6d0bfaad4bad8293920853c881c850
SSDEEP

768:Gsb8bXSSHJ6IdV+zP46Ta4WmgqPagF+y2/erHT9f3e+Y:L8bXSSpfdVkA6TaxVOagAy2WbT1Q

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\dljj_df = "C:\\Windows\\system\\llzjy080828.exe"	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system\llzjy080828.exe	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
File opened for modification	C:\Windows\system\llzjy080828.exe	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
File opened for modification	C:\Windows\system\dljj32a.dll	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
File created	C:\Windows\system\dljj32a.dll	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{ACCA8966-FF2D-11EE-B9F7-6257B05D87B4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2046736228"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101754"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2046736228"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101754"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ACCA8968-FF2D-11EE-B9F7-6257B05D87B4}.dat = "0"	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
212	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
Token: SeDebugPrivilege	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
Token: SeDebugPrivilege	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
Token: SeDebugPrivilege	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3504	iexplore.exe
3504	iexplore.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3504	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe	94
PID 2620 wrote to memory of 3504	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe	94
PID 3504 wrote to memory of 4032	3504	iexplore.exe	96
PID 3504 wrote to memory of 4032	3504	iexplore.exe	96
PID 3504 wrote to memory of 4032	3504	iexplore.exe	96
PID 2620 wrote to memory of 3504	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe	94
PID 2620 wrote to memory of 2216	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe	103
PID 2620 wrote to memory of 2216	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe	103
PID 2620 wrote to memory of 2216	2620	fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe	103
PID 2216 wrote to memory of 212	2216	cmd.exe	105
PID 2216 wrote to memory of 212	2216	cmd.exe	105
PID 2216 wrote to memory of 212	2216	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd1c1fc717004317f6e40b7d87be87c1_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\program files\internet explorer\iexplore.exe
  "C:\program files\internet explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3504 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\dfDelmlljy.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\lljydf16.ini

Filesize
86B

MD5
741566d74a82afcb7581a328a06ff31f

SHA1
ff5d6b51a3afa6b8dc2a35302ff9a5a351600c51

SHA256
9e2e9b6bffc82b675f8c86f974c03e8dd7e1683d7dcbb45d87e8f98828890947

SHA512
3a5d68c221fe2d6d012d66b3d61a82efdcd43cb8524584701d144a9a8491b537d5a6f46b0151a0e40de1c4eb547796a08da3f8098f499413425b7998c83ce431

Download Submit
C:\dfDelmlljy.bat

Filesize
233B

MD5
9431d6f60b1fcd93172d3b49d8cc39cf

SHA1
c4c50d4b344175782d52fe46c34fd83ff51d8b96

SHA256
d3a0f857b6b422bdfd119c49141e432b61f9fc51aaa6dc3019ba29a34b2fa86f

SHA512
c7ed31ea8ca13b6ef390ddb8b9d910f34502645c938074063cefa444f75a28f94d91e084c4948cad87a9ffe62752cfb407c638533815d6bfb365d129c1afaf5d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads