516935769ce832ae4e31e38ae0764009f90b55208710b29987f9289bd4fafc3d

General

Target

38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe
Size

259KB
MD5

38f151b5164d18158be1d6e3493a897d
SHA1

b3dd8da39983db5e8f582e1715e36b80eb51aaba
SHA256

516935769ce832ae4e31e38ae0764009f90b55208710b29987f9289bd4fafc3d
SHA512

94b73294bb46c4ecfd2ca32a27885c9f5ac99cfc7bce758e89d1dc7719c7dccaeef9558f96c94bfa734d603266397fa202e6f5a56401e1c497f9ce4a59fe3131
SSDEEP

6144:S16bnUWDUqJDdfMixNz9z+LS0X8W3Yp/UTxNbt0O4xy4qjqYq4lH:S16bULqFdEixN0j6/Oh0nxBgqYPH

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
persistence privilege_escalation

AppCert DLLs
T1546.009

Deletes itself 1 IoCs

pid	Process
2728	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1144	Explorer.EXE

Loads dropped DLL 6 IoCs

pid	Process
1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2728	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\chardkey.dll	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe
File created	C:\Windows\system32\chardkey64.dll	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2208	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2208	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2208	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2208	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	31
PID 1640 wrote to memory of 2728	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	32
PID 1640 wrote to memory of 2728	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	32
PID 1640 wrote to memory of 2728	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	32
PID 1640 wrote to memory of 2728	1640	38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe	32
PID 2728 wrote to memory of 2912	2728	cmd.exe	34
PID 2728 wrote to memory of 2912	2728	cmd.exe	34
PID 2728 wrote to memory of 2912	2728	cmd.exe	34
PID 2728 wrote to memory of 2912	2728	cmd.exe	34
PID 2208 wrote to memory of 1144	2208	rundll32.exe	20
PID 2208 wrote to memory of 1144	2208	rundll32.exe	20

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2912	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:1144
- C:\Users\Admin\AppData\Local\Temp\38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\chardkey64.dll",CreateProcessNotify
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\259460472.bat" "C:\Users\Admin\AppData\Local\Temp\38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe""
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\38f151b5164d18158be1d6e3493a897d_JaffaCakes118.exe"
      4⤵
      Views/modifies file attributes
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Privilege Escalation

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259460472.bat

Filesize
97B

MD5
d226a657b279c5fc0a892748230a56ff

SHA1
fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5

SHA256
9dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761

SHA512
07d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a

Download Submit
C:\Windows\system32\chardkey64.dll

Filesize
97KB

MD5
d3794ac0ee31e37e43a0f603051fe600

SHA1
e4967d81ee19f2b947e7808031cb356a80248534

SHA256
d183d2922fce4964f86c352f276241d2b4be1330c12b25491b6c668ff0c10989

SHA512
c34725feb906ad23f96f1e12499df8c119707509d17b745f8f9ba6755c9caab82f1aee47048987dfd1b35c3337ddb63acb02cfe551797069b28ac3ccc9870551

Download Submit
\Windows\SysWOW64\chardkey.dll

Filesize
88KB

MD5
bbf62c6be49d997b450c940afb342de4

SHA1
368d62826a0c24c60df60f4fa2a8ee29f5bce85b

SHA256
f16332e20ace5a4610cb9ee1ca0fcea41bcbf6136224ba7fafc6d1d7d4fffd6d

SHA512
745e718abfe25469436a30f12de77c65cec5f79d6552d98409d40f097130d1c3818f435200c6d34e46191e8fc687f42240d11b29bffbaf38a11cb5468d51f2f3

Download Submit
memory/1144-33-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1144-34-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1144-39-0x0000000180000000-0x000000018001D000-memory.dmp

Filesize
116KB

Download
memory/1640-1-0x0000000000750000-0x00000000007D0000-memory.dmp

Filesize
512KB

Download
memory/1640-2-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download
memory/1640-27-0x0000000001000000-0x0000000001042000-memory.dmp

Filesize
264KB

Download
memory/1640-28-0x0000000000750000-0x00000000007D0000-memory.dmp

Filesize
512KB

Download
memory/2208-12-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2208-32-0x0000000180000000-0x000000018001D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads