5dbd65f2584be715835c0ea8717cbd0517ae4c3f16b0f3d328705ff1c2cc7f41

General

Target

02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Size

69KB
MD5

02aea393d02e1aa8db1ffefeda93067b
SHA1

205c032c69e860d6dc3227b0ded4f94a823cefaa
SHA256

5dbd65f2584be715835c0ea8717cbd0517ae4c3f16b0f3d328705ff1c2cc7f41
SHA512

4f58411108400070f242c65dbd80aca162e34ddb533f9339fd7db472266db6a1482db94fa701d2e68325322f89d47aa20c3b4b886e7c26fb37e154e8859862e1
SSDEEP

768:9YMHSV9C0wh8PCnXnDqn+3h2qvdxnacva8/0xO/SV/lV/+V/:9cC0S1nXn+n+3AgJacD0lzQ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1728	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
1728	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
1728	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
1728	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
1728	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
1728	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Client = "C:\\Windows\\system32\\wuclient.exe"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XPSP2 Firewall = "C:\\Windows\\system32\\xpsp2fw.exe"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ivedpi-2-.dll	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ldpms-w.dll	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mstrtsch.dll	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\meIdPviap.dll	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wuclient.exe	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpsp2fw.exe	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nteonwin.dll	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\favico.dat	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wuclient.exe	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsp2fw.exe	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\luiTa-1-0.dll	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Search	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Bar = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchUrl	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://4count.com/?b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

Modifies data under HKEY_USERS 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Search	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Main\Search Page = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchUrl	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchUrl	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Search	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Main	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Main\Search Page = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Search	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchUrl = "http://4count.com/?a=2&b=test"	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Main	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4713e1ae-e27c-5d1c-f86b-389f0d74713e}\ = 10000000000000001000000004a0f0d21000000004a0f0d2170000001e0000001010000000000000000000007f65747e7f66787f00010000001010000000000000000000007867747561783c233c000a0000001010000000000000000000007d75617c623c6600040000001010000000000000000000007c62656365627279000c0000001010000000000000000000007c745875416778706100110000001010000000000000000000007d647845703c203c21000000000000000000	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4713e1ae-e27c-5d1c-f86b-389f0d74713e}	02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02aea393d02e1aa8db1ffefeda93067b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ivedpi-2-.dll

Filesize
9KB

MD5
8dd6fc2bfd42216ef8cfe3074272f6dd

SHA1
0a6ab097c20caa4855770958f07bed987ecedb62

SHA256
007c032174c60f93be73ddad07587e0eb4ed4626868b7c04f5cb4e2d4cebc988

SHA512
307df36c4653d560fdda37cc7a0028c43dd4eb311346d17e00d0248adfd5dc4f393516cea7d6ddfbfc77b4d4fecf0ef39575eeb98c08c66ca70ea089d8af8ec3

Download Submit
\Windows\SysWOW64\ldpms-w.dll

Filesize
4KB

MD5
486f17c9477593d38a840dda7f222b13

SHA1
d4e4725323efb19c738490ceff523a2e6004cba0

SHA256
d32cc6f742a70a3d2a2cd3fd065bf74d7c4afb9aac6ac93d30d4ad2d07bcd8aa

SHA512
ec8e6de35b25a2df512c31b6422095262de97ab6647eec02b820ea9e243fd256a9b6bd25be2dd44abcc6b64410b02c1906e541abd7cf817bb07af92c55abf994

Download Submit
\Windows\SysWOW64\luiTa-1-0.dll

Filesize
4KB

MD5
1fcc1602769673ea789a9e4dae8503c6

SHA1
cfb5c9d668c37509c01b85b50ee8978da83bbb58

SHA256
c2e04aa975466a1c885f418b98e950f4bd07bd082f120aecd8c043e0b9ff070d

SHA512
08f39c25b97151d38345fab03f868fcd8815ab960af66fd4ab07b991baa608ee4c4c83dd2fe31b1274cc3fea7d3b2f0eac340393757fc6d9a3f89ec668b9c9a1

Download Submit
\Windows\SysWOW64\meIdPviap.dll

Filesize
4KB

MD5
01bfb490a852e1279df166097d1dca3f

SHA1
3d206848af8e1c46d0cfad357aec468ffe1ce767

SHA256
a6c6e151e08befa8c1806b9d43ef0ceac6b214886765b5bae1e69971074d9d77

SHA512
be0947893676cc7675b2d3a654cf1e27bb026f260355efb8175c054be66497ba04dc4e20a58a53fb247c14caf912e6b77831085e93bae6d529f62b94bcfddecc

Download Submit
\Windows\SysWOW64\mstrtsch.dll

Filesize
4KB

MD5
abdb64e2e7f7a8eb624d38e722ada09c

SHA1
4c7dc1d3952201492c3b471e130e870a04283eac

SHA256
56d3b76972b36b71011c8d826b3ff40a38519473f23ac3ec6db09b923b10d14c

SHA512
abe143c65fa5fb5d4e1066d42bc10bd8cc8e1da00f08f31e4e01e037abf429355042a069d298cc8a744111fa1f7f519f385fb95f1da46d148dced0b8cfaee4f3

Download Submit
\Windows\SysWOW64\nteonwin.dll

Filesize
1KB

MD5
eedb624e3357efe3cda6e00c75ebfdf8

SHA1
24fe87d3d66382e3985b08d133f3a84220130655

SHA256
7a6c3c6b87f74deb741c8a5839c6fa41c7c2d93b83c29569c2f80961449cde8c

SHA512
590d80cfea7a10480be97bce4512f34cbf25d9e0f5dd2b6ba6920c2169a39e430ba1d2a94cfeb0dc25c29b67eab354a7b62b2789832cbd407e6528f4162a361d

Download Submit
memory/1728-13-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1728-17-0x0000000001DD1000-0x0000000001DD2000-memory.dmp

Filesize
4KB

Download
memory/1728-16-0x0000000001DD0000-0x0000000001DD4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads