0c8e71c4f82e18be73464bfdddd58080c94ba5481946d735e34bd48ad4decfbf

General

Target
79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
Size 2.1MB
Sample240527-vlf77aca89
SHA256 0c8e71c4f82e18be73464bfdddd58080c94ba5481946d735e34bd48ad4decfbf
MD5 79d7f5a22196dec5179c7763e70a8bbb
SHA1 f493729da7722f1135604cb4b31d2d82d8f95654
SHA512 31e943b6c78ef19b7452203fe2353a432c67a3eb72787d287111c250289d6e3a66b4c5bc4f740513f3c31efced104cb5d9f148c3467b3f83c0fcd241eb356e31
SSDEEP 49152:yiqXjFPE6KQaqz5HgrqhPLKqXZj8CTbDyhsotbgJSg79g3Ze7:yzzFM7q1Hg2hP2oZo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
456	svchost_ms.exe
3832	svchost_ms.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost_ms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost_ms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost_ms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost_ms.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SmartData\svchost_ms.exe	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\SmartData\svchost_ms.exe	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
File created	C:\Program Files (x86)\SmartData\performer.exe	svchost_ms.exe
File opened for modification	C:\Program Files (x86)\SmartData\performer.exe	svchost_ms.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Bios	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost_ms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost_ms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost_ms.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost_ms.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost_ms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost_ms.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3540	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
3540	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
3832	svchost_ms.exe
3832	svchost_ms.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3832	svchost_ms.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 2096	3540	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe	85
PID 3540 wrote to memory of 2096	3540	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe	85
PID 3540 wrote to memory of 2096	3540	79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe	85
PID 2096 wrote to memory of 1528	2096	cmd.exe	87
PID 2096 wrote to memory of 1528	2096	cmd.exe	87
PID 2096 wrote to memory of 1528	2096	cmd.exe	87
PID 2096 wrote to memory of 456	2096	cmd.exe	92
PID 2096 wrote to memory of 456	2096	cmd.exe	92
PID 2096 wrote to memory of 456	2096	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79d7f5a22196dec5179c7763e70a8bbb_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /S /C choice /C Y /N /D Y /T 3 & "C:\Program Files (x86)\SmartData\svchost_ms.exe" /start
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1528
- - C:\Program Files (x86)\SmartData\svchost_ms.exe
    "C:\Program Files (x86)\SmartData\svchost_ms.exe" /start
    3⤵
    - Executes dropped EXE
    PID:456

C:\Program Files (x86)\SmartData\svchost_ms.exe
"C:\Program Files (x86)\SmartData\svchost_ms.exe" /srv
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost_ms.exe

Path C:\Program Files (x86)\SmartData\svchost_ms.exe
Size 2.1MB
SHA256 0c8e71c4f82e18be73464bfdddd58080c94ba5481946d735e34bd48ad4decfbf
MD5 79d7f5a22196dec5179c7763e70a8bbb
SHA1 f493729da7722f1135604cb4b31d2d82d8f95654
SHA512 31e943b6c78ef19b7452203fe2353a432c67a3eb72787d287111c250289d6e3a66b4c5bc4f740513f3c31efced104cb5d9f148c3467b3f83c0fcd241eb356e31
SSDEEP 49152:yiqXjFPE6KQaqz5HgrqhPLKqXZj8CTbDyhsotbgJSg79g3Ze7:yzzFM7q1Hg2hP2oZo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads