c09ebeaea56c35dc596063f94f77cd9b0ad56634e433194f0700017baea6be13

General

Target

484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
Size

1.1MB
MD5

484757fa1e1b5714d28c0104043b0c17
SHA1

6efbb316ed1f8255e7d38c6c346c12c527e0a88f
SHA256

c09ebeaea56c35dc596063f94f77cd9b0ad56634e433194f0700017baea6be13
SHA512

85cb08395f15bb657c17f529b42eca0ccf107d86bfe3f4e46130de7f4aaa835c0eee7c78d6374504e62da9c8ebfb3ae8591dccd8c4fc739240e1d595dcbfc25b
SSDEEP

24576:7Cdxte/80jYLT3U1jfsWaXxhBrVSYgLQ6:Sw80cTsjkWahhBrIw6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2672 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2672	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 34 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000a858f071122041707044617461003c0008000400efbea858f071a858f0712a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000af58e8b1102054656d700000360008000400efbea858f071af58e8b12a00000001020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000a8589076100041646d696e00380008000400efbea858f071a85890762a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000a858357310204c6f63616c00380008000400efbea858f071a85835732a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000a858f0711100557365727300600008000400efbeee3a851aa858f0712a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2756 PING.EXE

pid	process
2756	PING.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe

pid	process
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 1300 wrote to memory of 2000	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	explorer.exe
PID 1300 wrote to memory of 2000	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	explorer.exe
PID 1300 wrote to memory of 2000	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	explorer.exe
PID 1300 wrote to memory of 2000	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	explorer.exe
PID 1300 wrote to memory of 2672	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	cmd.exe
PID 1300 wrote to memory of 2672	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	cmd.exe
PID 1300 wrote to memory of 2672	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	cmd.exe
PID 1300 wrote to memory of 2672	1300	484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe	cmd.exe
PID 2672 wrote to memory of 2756	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2756	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2756	2672	cmd.exe	PING.EXE
PID 2672 wrote to memory of 2756	2672	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp
2⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 localhost > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\484757fa1e1b5714d28c0104043b0c17_JaffaCakes118.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\PING.EXE
ping -n 2 localhost
3⤵
- Runs ping.exe
PID:2756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2948

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x0000000003D10000-0x0000000003D20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads