0fb87ea5c45560676f963358531e27d8f368c7a7f4de66d24b93964c6a46c179

General

Target

6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe
Size

2.1MB
MD5

6902bbf6691e2ce016859066f9959a7f
SHA1

2aaa79cb56458eb8d6db867fdb34fe8535b995db
SHA256

0fb87ea5c45560676f963358531e27d8f368c7a7f4de66d24b93964c6a46c179
SHA512

06ae9b01f79ecb7cba3dc88a5b465fa123ff967c75721832308523fcd8aa3eeae8db090cff31493c27c2f6c60a53b5777d4dda251d24f5f2464f103d30da0960
SSDEEP

49152:yiqXjFPE6KQaqz5HgrqhPLKqXZj8wTbDyhsotbgJSg79g3Ze7:yzzFM7q1Hg2hP2o3o

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

svchost_ms.exesvchost_ms.exe

pid process

1904 svchost_ms.exe
1668 svchost_ms.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1904	svchost_ms.exe
1668	svchost_ms.exe

Drops file in System32 directory 4 IoCs

Processes:

svchost_ms.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost_ms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost_ms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost_ms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost_ms.exe

Drops file in Program Files directory 4 IoCs

Processes:

svchost_ms.exe6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\SmartData\performer.exe	svchost_ms.exe
File opened for modification	C:\Program Files (x86)\SmartData\performer.exe	svchost_ms.exe
File created	C:\Program Files (x86)\SmartData\svchost_ms.exe	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\SmartData\svchost_ms.exe	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Bios	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

svchost_ms.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost_ms.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost_ms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost_ms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost_ms.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost_ms.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exesvchost_ms.exe

pid	process
4092	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe
4092	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe
1668	svchost_ms.exe
1668	svchost_ms.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost_ms.exe

description pid process

Token: SeTcbPrivilege 1668 svchost_ms.exe

description	pid	process
Token: SeTcbPrivilege	1668	svchost_ms.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 4092 wrote to memory of 1056	4092	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe	cmd.exe
PID 4092 wrote to memory of 1056	4092	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe	cmd.exe
PID 4092 wrote to memory of 1056	4092	6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe	cmd.exe
PID 1056 wrote to memory of 4636	1056	cmd.exe	choice.exe
PID 1056 wrote to memory of 4636	1056	cmd.exe	choice.exe
PID 1056 wrote to memory of 4636	1056	cmd.exe	choice.exe
PID 1056 wrote to memory of 1904	1056	cmd.exe	svchost_ms.exe
PID 1056 wrote to memory of 1904	1056	cmd.exe	svchost_ms.exe
PID 1056 wrote to memory of 1904	1056	cmd.exe	svchost_ms.exe

C:\Users\Admin\AppData\Local\Temp\6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6902bbf6691e2ce016859066f9959a7f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /S /C choice /C Y /N /D Y /T 3 & "C:\Program Files (x86)\SmartData\svchost_ms.exe" /start
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:4636

C:\Program Files (x86)\SmartData\svchost_ms.exe
"C:\Program Files (x86)\SmartData\svchost_ms.exe" /start
3⤵
- Executes dropped EXE
PID:1904

C:\Program Files (x86)\SmartData\svchost_ms.exe
"C:\Program Files (x86)\SmartData\svchost_ms.exe" /srv
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SmartData\svchost_ms.exe
Filesize
2.1MB

MD5
6902bbf6691e2ce016859066f9959a7f

SHA1
2aaa79cb56458eb8d6db867fdb34fe8535b995db

SHA256
0fb87ea5c45560676f963358531e27d8f368c7a7f4de66d24b93964c6a46c179

SHA512
06ae9b01f79ecb7cba3dc88a5b465fa123ff967c75721832308523fcd8aa3eeae8db090cff31493c27c2f6c60a53b5777d4dda251d24f5f2464f103d30da0960

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads