e62c8cd2f6c10bfd731dca630fdd4c8e3d5c9b391976f4402d08a4fe11c49c50

General

Target

3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe
Size

25KB
MD5

3ab1dec4931563c5724b855a1ca8748d
SHA1

acb012e2c454afdebc97924a6bbc935f24bdcde7
SHA256

e62c8cd2f6c10bfd731dca630fdd4c8e3d5c9b391976f4402d08a4fe11c49c50
SHA512

968b2000ae29c381dd5229f7f26fa7820727fd0d742ae872468ae355de0f824476e1ce753cbf5b657f4f9e7b55f2bd0e8faeafb4a6a1c4ef99a25b2df21a21a9
SSDEEP

384:zdj4sgLfWCGJY6O4DTGm4hEEZxgoZFNQsLFOwiC2wKsEaVh2O9h8CQO4Hej0EvO3:CO5y6O4D2hvZF6uVDEg2O9h3y8pvO4a

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1232	1846741.tmp
2404	1572419169.tmp

Loads dropped DLL 4 IoCs

pid	Process
2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe
2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe
2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe
2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95CD5E41-3FC8-11EF-920C-D692ACB8436A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	1572419169.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	1572419169.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1232	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	29
PID 2064 wrote to memory of 1232	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	29
PID 2064 wrote to memory of 1232	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	29
PID 2064 wrote to memory of 1232	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	29
PID 2064 wrote to memory of 2404	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2404	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2404	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	30
PID 2064 wrote to memory of 2404	2064	3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe	30
PID 2164 wrote to memory of 2824	2164	iexplore.exe	32
PID 2164 wrote to memory of 2824	2164	iexplore.exe	32
PID 2164 wrote to memory of 2824	2164	iexplore.exe	32
PID 2164 wrote to memory of 2824	2164	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ab1dec4931563c5724b855a1ca8748d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\1846741.tmp
  "C:\Users\Admin\AppData\Local\Temp\1846741.tmp" "C:\Users\Admin\AppData\Local\Temp\265006334.tmp"
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Users\Admin\AppData\Local\Temp\1572419169.tmp
  "C:\Users\Admin\AppData\Local\Temp\1572419169.tmp"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:2404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\265006334.tmp

Filesize
512B

MD5
bb1f3e8cdd2cff98df9f610b9bd6ed0a

SHA1
7b32463044a509c76cb132bfdea3752c7398292b

SHA256
58cfb4141d2b48eeaad6cf49f380c5f7c6e928e837b8f9027e5b5c557a2700f0

SHA512
e819822f3bd7a2b16ca41b90f0c4d69407df45df113e7ff6176108d00c567e9f3fc977910f6bb260c31e16b7e63e592e19f6e0fa1ecc531d582e4c312d89edfb

Download Submit
\Users\Admin\AppData\Local\Temp\1572419169.tmp

Filesize
11KB

MD5
89ac0ab758760063cfef626ce0ac92a4

SHA1
9998678f454a617789d25c1e7d58dfaf058e13be

SHA256
cb14ffc026b008e203dd1a5ed28a0ffc322fa32c170846d9485e5892554ce96c

SHA512
98d22e7f56b9662a117f409521bea73e3585b9b16f167dc1f1f01711c7dde1ea941d669ebfed993c925acf1c62e46f559bb61ebcf75451067620e9126ed47458

Download Submit
\Users\Admin\AppData\Local\Temp\1846741.tmp

Filesize
4KB

MD5
b7547f90ea7b2c21796d7a056c912f64

SHA1
7c67aab307aff97cf3e82119dfc3ffd3cf33f3e7

SHA256
3a31834ab501275479b980ae73ed339d00bce77cc7fd2846873f3145cc1ef359

SHA512
a334590f2ec1797b71121eb404c6ee32544ab0f7c2384f1939c1ab5671e971693162c876753d2a7286c0f600411769520b0fd2f99c5162000e7857f9ed17359d

Download Submit
memory/2404-19-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads