d646ecf9a3129198c6b1d832518fce34e093851c21e32c99353779c428da3833

General

Target

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe
Size

129KB
MD5

fe90d5dfa60dad355df93bd04bf6fa50
SHA1

c52a3f8818598932bb70916d7b9af3f10e2f2e08
SHA256

d646ecf9a3129198c6b1d832518fce34e093851c21e32c99353779c428da3833
SHA512

e635d45bb07311fcce15f60c7fdb77478b1cdf4af500d73379d2430a8a06d07432cb23b651bff5527a2b0abffe9046f2d67a726f841be99be36566bbd65aa5bf
SSDEEP

1536:dgb+dHlIFvviUq2VXtxOowiVdIyk4Xys4GTNKan4bFpb251VrGrT86Swnmio3+j4:BdSBv1xRIyk/ANK8IJ86QxoI/

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe:*:Enabled:Java Updater"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

4564 explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Java Updater = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe"	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

3340 reg.exe
788 reg.exe

pid	process
3340	reg.exe
788	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exe

pid	process
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe
4564	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

4564 explorer.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 4564 explorer.exe

description	pid	process
Token: SeDebugPrivilege	4564	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3176 wrote to memory of 3980	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 3980	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 3980	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 1412	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 1412	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 1412	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 884	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 884	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 3176 wrote to memory of 884	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 1412 wrote to memory of 3340	1412	cmd.exe	reg.exe
PID 1412 wrote to memory of 3340	1412	cmd.exe	reg.exe
PID 1412 wrote to memory of 3340	1412	cmd.exe	reg.exe
PID 3980 wrote to memory of 220	3980	cmd.exe	reg.exe
PID 3980 wrote to memory of 220	3980	cmd.exe	reg.exe
PID 3980 wrote to memory of 220	3980	cmd.exe	reg.exe
PID 884 wrote to memory of 788	884	cmd.exe	reg.exe
PID 884 wrote to memory of 788	884	cmd.exe	reg.exe
PID 884 wrote to memory of 788	884	cmd.exe	reg.exe
PID 3176 wrote to memory of 4564	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe
PID 3176 wrote to memory of 4564	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe
PID 3176 wrote to memory of 4564	3176	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v "FirewallDisableNotify" /t REG_DWORD /d "1" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v "FirewallDisableNotify" /t REG_DWORD /d "1" /f
3⤵
PID:220

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3340

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Java Updater" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Java Updater" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:788

C:\Users\Admin\AppData\Roaming\explorer.exe
"C:\Users\Admin\AppData\Roaming\explorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2664

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\explorer.exe
Filesize
129KB

MD5
fe90d5dfa60dad355df93bd04bf6fa50

SHA1
c52a3f8818598932bb70916d7b9af3f10e2f2e08

SHA256
d646ecf9a3129198c6b1d832518fce34e093851c21e32c99353779c428da3833

SHA512
e635d45bb07311fcce15f60c7fdb77478b1cdf4af500d73379d2430a8a06d07432cb23b651bff5527a2b0abffe9046f2d67a726f841be99be36566bbd65aa5bf

Download Submit
memory/3176-0-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/3176-1-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/3176-2-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/3176-20-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-16-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-18-0x00000000015E0000-0x00000000015F0000-memory.dmp

Filesize
64KB

Download
memory/4564-19-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-21-0x00000000015E0000-0x00000000015F0000-memory.dmp

Filesize
64KB

Download
memory/4564-22-0x0000000074710000-0x0000000074CC1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-23-0x00000000015E0000-0x00000000015F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads