0b19c0dcbbe2373a8b6b3b830c01f7a4753c5b7e16f625a5565cfb1bc4e3a388

General

Target

1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
Size

1.3MB
MD5

1674eddb9c8f866b645da885f6cd3105
SHA1

7f5b5fed89195ca1cf53b77d3bb0b069de64e878
SHA256

0b19c0dcbbe2373a8b6b3b830c01f7a4753c5b7e16f625a5565cfb1bc4e3a388
SHA512

f33f7aaea9b77b0158f87eda7b5d22a655584a2ae03cde0432caca5b8b41fdca5665ed2ebab072f03d45c6f41f9f5accf33254a60a664ca9090b6b6e607e5b25
SSDEEP

24576:Ct93K0zZsAAOsDkBaUXjv4Pk8hrmBQ/n5Gq52Kxu2:q93PVODkBaUMuBIn5y

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4940	pav.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAV = "C:\\Program Files (x86)\\PAV\\pav.exe"	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAV = "C:\\Program Files (x86)\\PAV\\pav.exe"	pav.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	pav.exe
File opened (read-only)	\??\H:	pav.exe
File opened (read-only)	\??\M:	pav.exe
File opened (read-only)	\??\Q:	pav.exe
File opened (read-only)	\??\W:	pav.exe
File opened (read-only)	\??\G:	pav.exe
File opened (read-only)	\??\X:	pav.exe
File opened (read-only)	\??\P:	pav.exe
File opened (read-only)	\??\R:	pav.exe
File opened (read-only)	\??\V:	pav.exe
File opened (read-only)	\??\Y:	pav.exe
File opened (read-only)	\??\E:	pav.exe
File opened (read-only)	\??\I:	pav.exe
File opened (read-only)	\??\K:	pav.exe
File opened (read-only)	\??\N:	pav.exe
File opened (read-only)	\??\T:	pav.exe
File opened (read-only)	\??\U:	pav.exe
File opened (read-only)	\??\J:	pav.exe
File opened (read-only)	\??\L:	pav.exe
File opened (read-only)	\??\O:	pav.exe
File opened (read-only)	\??\S:	pav.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winexplorer.dll.tmp	pav.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PAV\pav.exe	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\PAV\pav.exe	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Uninstall\PAV\Uninstall.lnk	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Uninstall\PAV\Uninstall.lnk	pav.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe
4940	pav.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4940	pav.exe
4940	pav.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4940	pav.exe
4940	pav.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4940	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	80
PID 644 wrote to memory of 4940	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	80
PID 644 wrote to memory of 4940	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	80
PID 644 wrote to memory of 4992	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	81
PID 644 wrote to memory of 4992	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	81
PID 644 wrote to memory of 4992	644	1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1674eddb9c8f866b645da885f6cd3105_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\PAV\pav.exe
  "C:\Program Files (x86)\PAV\pav.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1674ED~1.EXE > nul
  2⤵
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Uninstall\PAV\Uninstall.lnk

Filesize
1KB

MD5
a867544e6e43ce141bba7811d948ce9f

SHA1
8f98f01c3149d182d7ac6a9d6c704bb4c48ef3c0

SHA256
71bbacabc1b1588598f21b139adaceff219ca67438abb53251ecc0f592de722c

SHA512
5f1255e04459b4d56a0a7027f2075209eab8110858e8af4e4fa1b3bce32523235f3a8072ed5ad577ffd0ed45bbf7742ac80c6e0f35cb17252ce9b0bec7ad78cb

Download Submit
C:\Program Files (x86)\PAV\pav.exe

Filesize
1.3MB

MD5
1674eddb9c8f866b645da885f6cd3105

SHA1
7f5b5fed89195ca1cf53b77d3bb0b069de64e878

SHA256
0b19c0dcbbe2373a8b6b3b830c01f7a4753c5b7e16f625a5565cfb1bc4e3a388

SHA512
f33f7aaea9b77b0158f87eda7b5d22a655584a2ae03cde0432caca5b8b41fdca5665ed2ebab072f03d45c6f41f9f5accf33254a60a664ca9090b6b6e607e5b25

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\PAV\Personal Antivirus.lnk

Filesize
1KB

MD5
9e473b41fcf74229b80d2b3f0ef1c06e

SHA1
91ddb049da4e1317cd7d4493bdda35249ca6ed9e

SHA256
d5a1ed8c7f496c1986bf54eabfc186a9b07d0cffaa4566139f23e47cf56b5869

SHA512
8a92f1c9c6d3bea0ef500c893cea9e0f59083e72c50923f81086e1a8b63b81983ccb81251ae8be8a8080e636d70cd24050a084634376eead62fce0962d0fe8d7

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\PAV\Uninstall.lnk

Filesize
1KB

MD5
b6a643901325088a12bb196cd1a238f0

SHA1
6a136f200e9e0e5f7b4674cbacd23832c0a12c40

SHA256
1ab3ccca3de97b902fe5ebf14d555319d727db84baf57910f431359d95bf3efc

SHA512
01efd78538b8270e88c4da8a87978468c79b8a66182132f9c4c4bbf2416f98a72f0d9477320c4a4c273180e1387ee3772b6b0ffbceca8df425077455a10fcf27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\thanks[1].htm

Filesize
3KB

MD5
696c0a0d236283192a8b21b0f2832fea

SHA1
cfe7e970d479c9fc47fcddfa2893be261ba16807

SHA256
dc2517a0bfbc68dff4ddb7d4f79c6595f74540ca52d50df7eedf40f695e22505

SHA512
10a42dcf6940f63dd7bdbb86a9ff8522a3a966a699d15da8fb379a864f09cec23029c820ca286940c29b5b798626b9d107bf8c84dcc5bb74ea632bb631efd5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie

Filesize
91B

MD5
99bde3452748e34d6c50275110a6a8d4

SHA1
e79cb2a8db7d8490523529d3861f95ba73a20c23

SHA256
d07311acf641866e7e84823d2962f593bb655792301dc61ad6f0c6869d9c5937

SHA512
19fd529c6fe60bbbe3710fed93f14d723a13ad427431f855ed84f5e5e496b9f3eb8a6e8c31d740239eb225753d52a4f464b489fdbdeff4477480026263d0f691

Download Submit
C:\Users\Admin\Desktop\Personal Antivirus.lnk

Filesize
1KB

MD5
b2784f5404c2ee75dea9a097b2a0ac02

SHA1
7dfc6295af9daac8729d6d7c9f2931e8b3a3874d

SHA256
8d366400e13dabd164ead2ef9f763425b086a1874a11789557e784085055c02a

SHA512
ba401e3a64d93cfdc2c9ce9b2a397d09d9fa99bf41016a572f05ce7dcc37df2a24abf23043007c0f6448da70c3e01410b8c4960a01c3feb574f07ff6fabb17f9

Download Submit
memory/644-1-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/644-0-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/644-21-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-46-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-87-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-18-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-59-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-60-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-67-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-74-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-20-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-94-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-114-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-121-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-134-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-147-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download
memory/4940-160-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads