fbfe85bf45dd9197f58fa9295211bbfa36b81a16ce6d762898b35397349f3c85

General

Target

254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe
Size

547KB
MD5

254b3e6dca44ff69cc40688aadb88c45
SHA1

21c227a18f4b01789bfd12074cebef5e3b7ed2ee
SHA256

fbfe85bf45dd9197f58fa9295211bbfa36b81a16ce6d762898b35397349f3c85
SHA512

c337d15752ce6024e23ba144256baaf6467a70ddb4ef66c3b5ae9626196827013c5c65d5625136199a2a9bc8ee78f27a4135e9c435db1dd57bc7212fdba158a9
SSDEEP

12288:w/mzmQT7eaitUMKDBalz2m10NPtIzidNCN1yQ3uVPZNste0d65:wucaity1aliZdOaCNdlU665

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe
2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{628B2FB1-0D48-11EF-873B-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
992	IEXPLORE.EXE
992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2480	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2480	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2480	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2480	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2096	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2096	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2096	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2096	2512	254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe	34
PID 2096 wrote to memory of 992	2096	iexplore.exe	35
PID 2096 wrote to memory of 992	2096	iexplore.exe	35
PID 2096 wrote to memory of 992	2096	iexplore.exe	35
PID 2096 wrote to memory of 992	2096	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy /b "C:\Users\Admin\AppData\Local\Temp\nsi1DA0.tmp\SoHuVA_4.5.77.0-c207715-nti-ng-tp-s.exe" + "C:\Windows\Fonts\gulim.ttc" "C:\Users\Admin\AppData\Local\Temp\nsi1DA0.tmp\SoHuVA_4.5.77.0-c207715-nti-ng-tp-s.exe"
  2⤵
  PID:2480
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://120.26.154.44/254b3e6dca44ff69cc40688aadb88c45_JaffaCakes118.exe/40.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi1DA0.tmp\1.ico

Filesize
144KB

MD5
175945d5c411523fa8385a8a55c1b4e7

SHA1
f880b88af38ebd3f792f20009ddc1b0c7c9982f0

SHA256
00510b32f7495ee1be02aa72227ef24e4e143d9b7c52a7f8d80b70b4bbe0514e

SHA512
bfba5ee12ae4dd817b867673721f29894928ab894647dd75d5961a196aa12287b1b2da6f2327a4bb66920caa91073b93b2eebce2f71397e9f72add376a8eb4c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1DA0.tmp\1.zip

Filesize
72B

MD5
a602ac9d03cffedc03fa841c9a12df5a

SHA1
e42f39093e29f5c6c7aad8a973d69035e860659e

SHA256
f5d09365810dd11ef1204b35bfede3158a07d5592a9c9cfa449dd534f9964aa9

SHA512
78d0f33871a43d65abc4156fb3518190d5dd80c260a88a3de4e0ad4c129cfddafa3286af42d6748b7f16a6eb124a24d24d6025d1f3bf7ebc201403c431a013dc

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1DA0.tmp\System.dll

Filesize
11KB

MD5
535501f2cec26becb4c704e6c54604bd

SHA1
1227b0660de525a98d1056845d55928502d11c0e

SHA256
6887e6328885d1cb97abb9f87418ae722103f6b909cdfdc2c30f7c3493de4b88

SHA512
72c25244ae2aa875d5e845960d67439dbc7dab7d8ec5bc8ef22b1991dec02fe635535bcd7145584fbf67083b1214c2c534ad47ffd5eb7a33dc3ceef689341540

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1DA0.tmp\nsExec.dll

Filesize
6KB

MD5
f5193c3c9d1506d4dab391ca01b9b710

SHA1
88c3ef8adca644b864b7bcc1d0e2ccdd7b37a441

SHA256
b11f7cddf77436d2d9a64e859d21d14dc37a8fd7a39bb11e036edfa04ee0df23

SHA512
2a8fa55cba37148f20dc6fe644dbee531aa2c275a90b5e1c19a7430062286b9386dfd57ec4bba815fcc4b38806360fe5deb6d02ce8738bae6e21e92965509b86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads