269c5a0a27bdf44ea7d235ca420812465c880f6dac7d7f29957e7d9846db2335

General

Target

32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
Size

59KB
MD5

32d38b554579e5840cc746594d9a281f
SHA1

94785d2a57bd33b04795b915947e43a32c551461
SHA256

269c5a0a27bdf44ea7d235ca420812465c880f6dac7d7f29957e7d9846db2335
SHA512

8edbabea76a802938e51815e409b808e187eca0ed0c38dd82b6821e80a935b40c5f89d61b7ed95747a9425a499683335fa7080bfe3d429553eade476cb8aae19
SSDEEP

768:9H/mxdnhVI61Iv3JSHgrhjfvdW1lacva85tZB/CF/2F/:9AdhVx1I/JSHgr1NAlacNtZwQ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
3008	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Client = "C:\\Windows\\system32\\wuclient.exe"	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XPSP2 Firewall = "C:\\Windows\\system32\\xpsp2fw.exe"	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ledivati.dll	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\acayerdsn.dll	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wuclient.exe	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpsp2fw.exe	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\enactlien.dll	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cttingin.dll	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wuclient.exe	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsp2fw.exe	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cflitHo.dll	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d5f21799-be42-3357-85e7-af90bced5f21}	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d5f21799-be42-3357-85e7-af90bced5f21}\ = 88996677000000001000000004a0f0d21000000004a0f0d2510000001e000000101000000000000000000000747f7072657d78747f0001000000101000000000000000000000726565787f76787f00030000001010000000000000000000007d74757867706578000c00000010100000000000000000000070727068746375627f001100000010100000000000000000000072777d7865597e00	32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32d38b554579e5840cc746594d9a281f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\acayerdsn.dll

Filesize
4KB

MD5
6380abda9712be6706fdbce89c8b4b80

SHA1
83b31e90fc059ec717925137b3f31c9709fefd02

SHA256
d4f6ffa12e91a326d3e34e7cd873f142eec9ff9ece0350139eb491a8b2628f7a

SHA512
0363482461ff29ad604c28a31174abe3542d1109113fbfa1cd80db2433f43adc0a2fc2431386445f56c31368be37fc31fbe268b4ef4755ad2f08a29fc4e62d4a

Download Submit
C:\Windows\SysWOW64\cflitHo.dll

Filesize
4KB

MD5
ba2c90b51476a5637b40c1513523e183

SHA1
7d003d422525e794e4ea9eb70aace02c11e7ad9f

SHA256
f7166f71f5bbd5c00fea301d671c2f125bf2bbc326a01038d2afade3d5326980

SHA512
d969e712e66c9d0236ee9f38e4c09626e00c9f247dc5982a4026069c435dac5928f91b084f3edee8f15697f2a8abbfa8c38b929bbc5395569bf64aa56994bf7d

Download Submit
C:\Windows\SysWOW64\cttingin.dll

Filesize
9KB

MD5
324349fce2b4bd142b9ae1b15f9c1587

SHA1
96616d42ebd50eb4d68d99fb63fc2e3dd2d34238

SHA256
3429452fb65efc016517501c6481246cbd523d17f0f18ff6e3cf6c549a51fd73

SHA512
5457467aae0a717b0b676d285d591cafa5d99483914cb01efb1cb188b8309f3338fb3f2d09825d1a8b28cb84632f79455e464ca2b02ee71497dd4c757b9edd30

Download Submit
C:\Windows\SysWOW64\enactlien.dll

Filesize
1KB

MD5
5a1a51f07b19039892d00005921757b7

SHA1
224fc4c9a8354427859b26e8fdf0ce74e78119fd

SHA256
18c9989749906d51b51ba0d7c6f5cfc68d673fc7ae2f22eae376255b5354c7af

SHA512
c57c364f0601306494c19d5fe76f6d01da7e8adabe96a0c421131420164560c415cdf029c9a61bd9b765aeaadd8a922df71d128604385f95b065287f1018e338

Download Submit
C:\Windows\SysWOW64\ledivati.dll

Filesize
4KB

MD5
167662d438e6d4efd9a0b009ee08173a

SHA1
b808c74d1d690e8941dc9944df5d5f46ef37bc95

SHA256
93d9cd69d8c731a2ed7f394531b5f9671ff3853085c41569c6fb3c29cb06a2b1

SHA512
5a8216b4389e5f7187aefd72dd5f743673f7a1b48befff4c363c3a2a4ab30463822870422e99f314de73d726ee162939437a46aaf4bf59291a605954e10d12e9

Download Submit
memory/3008-13-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/3008-24-0x0000000002F30000-0x0000000002F34000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads