f33d5d3b13273257624743bc80a6620ef0e7aa44e7d740b57881f83efb944a37

General

Target

9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe
Size

316KB
MD5

9d2d055a4e93eef6672c6b125444c5b3
SHA1

267aa089dce51f26841cccf9ebd82ec4dac8541f
SHA256

f33d5d3b13273257624743bc80a6620ef0e7aa44e7d740b57881f83efb944a37
SHA512

b6c518c45bf42459b24c7cec18002e4f3d9e416174b8ccabf1c2a695dcabf7f254c2246c122a0c32642b0f14c9909d5ee011bd600c6bfbed6c49a14c61586d03
SSDEEP

6144:arabUzkuvcBYC47l2xgh2hyP9wUnIG2mQP6vxoG0rkKe:arDkuveY3N2eHnIPmQP6vqvm

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe
1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe
1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2504	1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe	29
PID 1304 wrote to memory of 2504	1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe	29
PID 1304 wrote to memory of 2504	1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe	29
PID 1304 wrote to memory of 2504	1304	9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d2d055a4e93eef6672c6b125444c5b3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin218A.bat"
  2⤵
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\InstallMate\1DF45739\cfg\1.ini

Filesize
795B

MD5
4008f1a2ba6598c9f8a7f3eeebe01039

SHA1
cf56a0ae847191d9ff3c9b92f3b4660d0ee57e42

SHA256
c5c37bdcb4534f1191f7660970c33acb52a3f85a4bfcacca6e446492737bd709

SHA512
89e3fe2cc5773c88bacd23cf326568ac987d97d779d399698e681f36d5fcd087ec553285b92a4290337c120cce5063c35cd7eaf7369589f051c899e0960b1e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_tin218A.bat

Filesize
50B

MD5
5aa45565506d87b0c90c30bda3064eef

SHA1
bb2b310eca45a842116a303ad8e0f55db94c16d0

SHA256
1ee7de62dab2f35a72344b443c418cee4ab9af0f37e6792e308f4876fa07ecf6

SHA512
955968ebc6f01daab6dc031e763170b6e13773b10ed0aee1ddfdb2bf6b0d110a3308007d0c4cb3bc41be5d659accec6de1b25586e20ace2e3a1c86f303100f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3512B8D7-DE55-42A7-A04C-9677EEF19A21}\Readme.txt

Filesize
2KB

MD5
8eef18ae516f2d7dbf2d71bc9db335a4

SHA1
aaeed7fcc65ff6a37dacf0a74e698c77082e6474

SHA256
668ff49410bd3dc59d0b720a57cad2b35c37e4045c3556f3f1a8fe41c3847353

SHA512
05f638e92e73688714c6d21ba7f30ece29bfeb88f924931032d59e02bb45bcf466fd56a60c983dcbadac8b96ba2b87a06148082f54c5e7b24aa103a14d3d7bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3512B8D7-DE55-42A7-A04C-9677EEF19A21}\Setup.exe

Filesize
15KB

MD5
e717f6ce3a7429bfa6d7f3cf66737a4b

SHA1
01f4042589b4ed88c351ffeac256be7a9d884818

SHA256
7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

SHA512
65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3512B8D7-DE55-42A7-A04C-9677EEF19A21}\Setup.ico

Filesize
4KB

MD5
dfb1021f953408c5517178c42a567ec6

SHA1
dbf6d933cde6982a7d259abfc1f439d56e947279

SHA256
fb0270fa717a638997657c6b8fd77fe6d65ae3fb0cfadc54f3542c25a966b6cc

SHA512
999cbdbb5e917ea9846d239a26c7f2e758a5abc23b2fae98b36889955cdf4c9b2cda4dbd365f048d3c26543f96fcfd267f7da1388f2c54293fbc046cf806de7f

Download Submit
\Users\Admin\AppData\Local\Temp\TsuC79BD720.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
\Users\Admin\AppData\Local\Temp\{3512B8D7-DE55-42A7-A04C-9677EEF19A21}\Custom.dll

Filesize
91KB

MD5
dc1e339686c8ccab49a2860c6709760b

SHA1
4662d7283d4ad26b4a235d82d831db526e9daa42

SHA256
07d70be92b1ef086f5f41f95fe14044fe8186e85a3972bb790ae143c66214f0b

SHA512
913e466fcae98118375c19e000c75ef03d7f5d30f16a29ad98fd90cbed425adf6415598b332cf30652a3dab2371e4a59a6a2c813d1df739bd09080e56aed9c52

Download Submit
\Users\Admin\AppData\Local\Temp\{3512B8D7-DE55-42A7-A04C-9677EEF19A21}\_Setup.dll

Filesize
173KB

MD5
849cfed02ed4ded563da47d93592b653

SHA1
bcdc289cf10557a0ee5b8a3f956739710215a4e5

SHA256
40f7374f5089a9429f4fe0d568364c567d535fa2d3d542d4f7dfb948c480be27

SHA512
8f6d24b7234efb6cbf11be13bfa11f5e6d11aea48d1c81c37a421862aa452b6af0a06bc8637b58bfae631a68aa0d532c7922ccca6433cd2e05e87198ad719cf0

Download Submit

Analysis

Sharing