812821bcf53366cb027030833e0bc011f74c1e6638837b63bbf5e57d9c7afa0c

System Information Discovery

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

winram.pif

pid process

1888 winram.pif
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Critical Task = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winram.pif"	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 myexternalip.com
13 myexternalip.com
4 myexternalip.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
8	myexternalip.com
13	myexternalip.com
4	myexternalip.com

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1216 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

pid process

3320 0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe
3320 0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

pid	process
1216	EXCEL.EXE

pid	process
3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe
3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

winram.pifEXCEL.EXE

pid	process
1888	winram.pif
1888	winram.pif
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE
1216	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

description	pid	process	target process
PID 3320 wrote to memory of 1888	3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe	winram.pif
PID 3320 wrote to memory of 1888	3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe	winram.pif
PID 3320 wrote to memory of 1888	3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe	winram.pif
PID 3320 wrote to memory of 1216	3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe	EXCEL.EXE
PID 3320 wrote to memory of 1216	3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe	EXCEL.EXE
PID 3320 wrote to memory of 1216	3320	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe	EXCEL.EXE

outlook_office_path 1 IoCs

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

outlook_win_path 1 IoCs

Processes:

0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0433b0f9de7d6604427b006242732d93_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3320

C:\Users\Admin\AppData\Local\Temp\winram.pif
"C:\Users\Admin\AppData\Local\Temp\winram.pif"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE" Microsoft Office
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

3

System Information Discovery

4

Lateral Movement

Collection

Data from Local System

T1005

Email Collection