abd726fe2c60842d8308a05fb28e5d71f4e86e8d2df834d3b1b8099e4d69d081

General

Target

2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
Size

1.7MB
MD5

2abe014851fba1a1f9d7ed18db917c8c
SHA1

bf25debd38148339f97831fd4b388e0f3bae8694
SHA256

abd726fe2c60842d8308a05fb28e5d71f4e86e8d2df834d3b1b8099e4d69d081
SHA512

9c0b5ea3e8e4865d3480639e3acbd5f196e5d8f318c6e4b82741b64d486f8ba64965b0dd64617d4165236a2c245f23b84c8aa65368c0dae5af0d9d0a422b2fa2
SSDEEP

24576:Ao7MPQg7P1/er8/wIawbnErJnOW5AWTklyo5ZThqvW8wmr2hjjAsama1lVrZwXdY:AISrPUQzDO89qu9h/Ax1lAy

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\State = "146432"	ie6wzd.exe

Executes dropped EXE 2 IoCs

pid	Process
4572	_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
2308	ie6wzd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\J:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\M:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\R:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\S:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\U:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\A:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\G:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\H:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\K:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\O:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\P:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\W:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\B:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\N:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\X:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\L:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\T:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\V:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened (read-only)	\??\E:	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\InstallShield\setup.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\_isdel.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\_isdel.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_e0dec3877978d84a\mscorsvw.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.19041.1_none_afe0be8163ecf7d4\XamlViewer_v0300.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File created	C:\Windows\Active Setup Log.txt	ie6wzd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\AppVStreamingUX.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_833d086e8f306c45\dfsvc.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_6a5de40c0a30489e\IEExec.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.19041.1_none_0bff5a051c4a690a\XamlViewer_v0300.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_ee822d264112a470\powershell_ise.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.19041.1_none_861f5c69fbf3d066\AppLaunch.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_8e850c52ac392ae6\dw20.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\~VSC728.tmp	ie6wzd.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVStreamingUX.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_26b5e44019fe7ae2\dfsvc.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_3fc8ddfd98ad3137\IEExec.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\setup.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\_isdel.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\setup.exe	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
520	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
520	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4572	520	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe	84
PID 520 wrote to memory of 4572	520	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe	84
PID 520 wrote to memory of 4572	520	2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe	84
PID 4572 wrote to memory of 2308	4572	_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe	85
PID 4572 wrote to memory of 2308	4572	_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe	85
PID 4572 wrote to memory of 2308	4572	_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe /S:"C:\Users\Admin\AppData\Local\Temp\_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe"
    3⤵
    - Manipulates Digital Signatures
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GLOBE.ANI

Filesize
6KB

MD5
f3525c9c46c7f01433424e8aa4d0eb7e

SHA1
b0faf41ef1e211e73a3d8bb1f26df609e68e12f9

SHA256
0c713d5db713333de26a82230c9aa4adb28e4451363a8a37cbfcbb4c6aee84b5

SHA512
8df3ff17273fb60e6ce71128eab0cf1fcba69421f3622b443e210d43f6005e5b51523c68e81ac384f8c3202a6d023a592ec51d4238c8c1d0fb371ba335aa4522

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IESetup.inf

Filesize
10KB

MD5
3cd2691a9f52b1b941571ae672056da2

SHA1
e0fb881c64eb4cd7a798fa4797bed1ed67f4429d

SHA256
418b3bafe8d86dd24f26ffb6ad293631ecb92c40140696299efdfa57c7b3ba23

SHA512
c6260e0ae62eeb7a5e3eb97356b017f0e5258741f9dd4b47202f6b088d3e3b7d6761b1a2c820c051ec2b4c350e5ac9ed2fc0f31430679f9c7776479e23650e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\advpack.dll

Filesize
91KB

MD5
1281c87960ba6cf861d064d93d3e7cdf

SHA1
7ec3ce696aaa47ed53a1d59ddeb99b56d6fd7dbd

SHA256
ded6a8dd631c18c21c9ab9dc7226a2c3262dbebef5a72ab22f13beb3bc11423b

SHA512
a8723bbd7454d33c2da861aed865efd63521ba6eb8da7c2bc7e8e894ba4fa34936f3a64e41024df8fe4ba12ccb8d3e6fc1a4e055f181cbe6ed2df706104d7293

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe

Filesize
192KB

MD5
9071ec9c2d8fd905e9ffeaf3aae88420

SHA1
196f72cabfb648794e92709b1ea9d8f7fa71693b

SHA256
6bc59849f3b025739d2f406f3b216e4c4a61e2ecbc5d04742cc55ead12afee27

SHA512
ab8b905601c2609c715ca77005c152be8d65deff7a50de2cc9f178aed178ea5451cc2e5b0bf830716b2072892b97245658469b61a19aab73c4afdbac216aebcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_2abe014851fba1a1f9d7ed18db917c8c_JaffaCakes118.exe

Filesize
484KB

MD5
778cdd7e72ecc9415fb1d6e7f32f24a8

SHA1
05224925e6cc58c3049fac14aed81efadc7b28b0

SHA256
99622651d5ca30a460a6a6e0147df6c8145ddd34b75fa26a38e714b4dbc5902d

SHA512
a612577578660683e462487692934bf0f936b759a4c5e8092f347639fe365f8caaf3c7b4983116e56720a33400611811b0b80e92b2bf307fbdd067cd159b2caf

Download Submit
memory/520-81-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/520-0-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/520-82-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/520-83-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/520-84-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/520-85-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/520-86-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/520-87-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads