803b1886f05978e17fa939399cc93af5fc4bf79d5c2edd4709af811871f88e28

General

Target

08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe
Size

174KB
MD5

08c6b2e495aed922f466cd63a22a5076
SHA1

f4ecf0b17dea534aa55606bd27fb13d6592b2e9c
SHA256

803b1886f05978e17fa939399cc93af5fc4bf79d5c2edd4709af811871f88e28
SHA512

b5321a3b240f08aa6978904e69a79c17f572054b82e40e065b94f1c63176d2c54a7b78cf8383073c35037240bef4cba3d33d7efe0d0c31126321a516724095ec
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hTA9uDCpLuSvvWob2Ei2ZFjyIoT:AbXE9OiTGfhEClq9ENCotob2EZVyIoT

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2120	i1.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ololo\test.bat	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\ololo\p.txt	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\ololo\ku4uqt.jpg	svchost.exe
File opened for modification	C:\Program Files (x86)\ololo\ku4uqt.jpg	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\ololo\i1.exe	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4616	mspaint.exe
4616	mspaint.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4616	mspaint.exe
2480	OpenWith.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4616	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	83
PID 1200 wrote to memory of 4616	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	83
PID 1200 wrote to memory of 4616	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	83
PID 1200 wrote to memory of 1524	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	84
PID 1200 wrote to memory of 1524	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	84
PID 1200 wrote to memory of 1524	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	84
PID 1200 wrote to memory of 2120	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	86
PID 1200 wrote to memory of 2120	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	86
PID 1200 wrote to memory of 2120	1200	08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08c6b2e495aed922f466cd63a22a5076_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Program Files (x86)\ololo\ku4uqt.jpg" /ForceBootstrapPaint3D
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ololo\test.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1524
- C:\Program Files (x86)\ololo\i1.exe
  "C:\Program Files (x86)\ololo\i1.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ololo\i1.exe

Filesize
21KB

MD5
1a81940649f1846e028ef96c14e9b951

SHA1
6569d983ad042407026a7b1e04966de1e7fd0606

SHA256
c040857f302c29ecce28f64d57d70a87742ef2d36aad2955d43e2340dea4ec3e

SHA512
8e528567f7fb7065304c06d9d3e99ecc0ddf89345481ea205c6e3f81bb88ad32aeb7824808e5d6cc47b6f61ffeb2fbb6387d5efc35b9c1607fff4e12c27991a7

Download Submit
C:\Program Files (x86)\ololo\ku4uqt.jpg

Filesize
45KB

MD5
827d52074dbca28426afaa3372865cbf

SHA1
473056850bc255f2506c3e0bd61c39d94596115c

SHA256
be0d55e4795861c78276223348422d4a8e7765544557ddd4db9e314a216c7f31

SHA512
c51fe7fd2066903216e65533fc024649d764a70ec39f07fdf7574268f2770f67d2943f45d4a5bf6fee383d91acde947cfbab73714a5a45bd94e63e7cdf294912

Download Submit
C:\Program Files (x86)\ololo\p.txt

Filesize
2B

MD5
34173cb38f07f89ddbebc2ac9128303f

SHA1
22d200f8670dbdb3e253a90eee5098477c95c23d

SHA256
624b60c58c9d8bfb6ff1886c2fd605d2adeb6ea4da576068201b6c6958ce93f4

SHA512
1ccbff33e55627a50beca8cf5c89f77c3165dcb3218171308423f250f0bb0be9700bbfdd92d35dfa2e579110266a40194d707b50e7d27b6f09b81fbbf80231a3

Download Submit
C:\Program Files (x86)\ololo\test.bat

Filesize
5KB

MD5
0a40aac6bf1e184142b8c2a518091324

SHA1
f4c5c784662e84b745a6c21e54ca67531b9031e2

SHA256
5a4e9b4e8252ed0f69702138bd00b4a90bf5ebbfd5a9b82f891f6d74e4168f6f

SHA512
3233e1c41f379afd2a04d8e71989b31fc7bbd764cfda6f5ec83a6bd28c6f39dd247bbb854a54f97b3f48ad8cde88fab63c2a1b177ec4e7e5bc6cf4870f5f2db2

Download Submit
memory/1200-32-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4164-37-0x00000206AD960000-0x00000206AD970000-memory.dmp

Filesize
64KB

Download
memory/4164-40-0x00000206AD990000-0x00000206AD9A0000-memory.dmp

Filesize
64KB

Download
memory/4164-47-0x00000206B65E0000-0x00000206B65E1000-memory.dmp

Filesize
4KB

Download
memory/4164-49-0x00000206B6660000-0x00000206B6661000-memory.dmp

Filesize
4KB

Download
memory/4164-51-0x00000206B6660000-0x00000206B6661000-memory.dmp

Filesize
4KB

Download
memory/4164-52-0x00000206B66F0000-0x00000206B66F1000-memory.dmp

Filesize
4KB

Download
memory/4164-53-0x00000206B66F0000-0x00000206B66F1000-memory.dmp

Filesize
4KB

Download
memory/4164-54-0x00000206B6700000-0x00000206B6701000-memory.dmp

Filesize
4KB

Download
memory/4164-55-0x00000206B6700000-0x00000206B6701000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing