6d293e882abf151bb399c8f8d00a5c9714bce8796942dad8c784f3eea1d02a61

General

Target

3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe
Size

326KB
MD5

3fc6f8f1b7b3a58c7d75d37f3522601a
SHA1

bc72a6f7879d412a91865d8520663e7d7e588372
SHA256

6d293e882abf151bb399c8f8d00a5c9714bce8796942dad8c784f3eea1d02a61
SHA512

2922a568d6ae90be55b74b5460972312473a4edc433c3ddf27ca26d91296b5bce616e901b65df668b0bdca843e829768a7a8693d7f956ae3d6c855c616c827a3
SSDEEP

6144:er469uEo2S1YnQmCX492DkwNP3qpYFhVq5fRr7kW2hjCmPLSysJma1:er4iu6/eIo44O0W2UY2yy1

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe
3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe
3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe
3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2092	3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe	85
PID 3728 wrote to memory of 2092	3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe	85
PID 3728 wrote to memory of 2092	3728	3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fc6f8f1b7b3a58c7d75d37f3522601a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin2308.bat"
  2⤵
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\287103B7\cfg\1.ini

Filesize
1009B

MD5
195daad81eeddb3240a3d118a97e460b

SHA1
4533788ffea076982bfc733bee55d3cc284bcf49

SHA256
e34830e865b824a3d78d45b000c6e99b682b8403b2e5eb8f444c9addc1d08698

SHA512
da50da4a3a8c2297f4af432015d3758402bcd06b6189fc420d2c53f0ee6c04569f68a2e45fd4a78382c95d72a6f1b81777479121ba4039766b0cf8d2ead34bd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tsu8258AA19.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin2308.bat

Filesize
50B

MD5
d42b67c46e855291402856883b20b960

SHA1
817cb12ca3612f68e73e12c2ba49df78c27b8ed6

SHA256
e678fe60ec45a17981ce537b0013b2c2ad41b4972989a0073875bddaf1b156f3

SHA512
4064549f28207a6c4ce90ee369b6d8206cc4d73177c1603ec27521fe48a16c9efacb8b15b68213af4c8cb95159b877ab6098cfeebb9a4bb8169340ec60af99ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9AE69732-E33C-469A-A471-AB1E4105B5C4}\Custom.dll

Filesize
91KB

MD5
0842e2723fff1f80955c9dbd38019c75

SHA1
bea88c3fe74817b048951bd218e70d9dead617d9

SHA256
d71cea96d49b48f8702337d01681b2f144aca8acb56a699b9599106c11cc7458

SHA512
28acff8e01224291aa67f57b2d514db84a79fc2cf7ed28ed2e2cecbdf070fb3b1cf52e295a9412641422338f78d86fc6ea21d835a8de21565a8f53d24c604b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9AE69732-E33C-469A-A471-AB1E4105B5C4}\Readme.txt

Filesize
2KB

MD5
59c049b7ee00ee5a8270ea536cdc40f9

SHA1
67aee7a6d0684be991a539b6a6658a6d7e950b33

SHA256
352428e1ccc4029aedcbc372fc60092228651e7606baf77abb3511abd163485e

SHA512
2b48efdf5db69a790bfe1d3a5be92430cd1ceef2297b11ccb0343ffffb587a66c1152a11f94344781c7b4e0bf8967d3f906d85ba422af5a14724cb8afd510e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9AE69732-E33C-469A-A471-AB1E4105B5C4}\Setup.exe

Filesize
15KB

MD5
e717f6ce3a7429bfa6d7f3cf66737a4b

SHA1
01f4042589b4ed88c351ffeac256be7a9d884818

SHA256
7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

SHA512
65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9AE69732-E33C-469A-A471-AB1E4105B5C4}\Setup.ico

Filesize
14KB

MD5
fd7ffd6a90536af8391733e3695e3740

SHA1
6774868b160ec653a594a8c29ebc5c432a6615bb

SHA256
dddc311ded9236e2c582d9df11639b8119c2d9265799f225d9efb047c9f3118a

SHA512
3279d7277d587df6c20ddccb487a24fb2cd41f88b701a93b1166bb8f3653b752509fd675858ccf12d7c47fea6b82c2e201e96bc54500b76fd9a6169681527638

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9AE69732-E33C-469A-A471-AB1E4105B5C4}\_Setup.dll

Filesize
179KB

MD5
35b1d5b099a7bccc1b38e0ca0ef5c47a

SHA1
3667c7290097cec828bd8e45c14a36b853c61ad2

SHA256
e03a8c9448bd7416f8fd2a5c306708e29972e4c0d6751d5c1dda68d7d0d2550b

SHA512
9c64d17cc6cf361422d2b2f6a9306138e51b9e1b71a6475cc06a67300e9897ee1d03cb6120f966a168003a54f64a0562aa8fd3566e0e66f01906cb31d7297a0f

Download Submit

Analysis

Sharing