2e27e349e8d1f9ec51b4a1dacd958b941bdfc0308ad9e68b0037a31b4880bdff

General

Target

407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
Size

1.3MB
MD5

407449f2a326a81163b76b7354cae031
SHA1

fb0f643c5d5e4a030d1228ae64f814a9daa122fd
SHA256

2e27e349e8d1f9ec51b4a1dacd958b941bdfc0308ad9e68b0037a31b4880bdff
SHA512

61d426289f82f34e87a69ea91b959136517e1e5017621e0a886f102831bfb17988a69d66316c1b92a17042bdfcbc68f1f7463b75bf049ea5e6bc1c1aea9fe435
SSDEEP

24576:nnqWpxcFsH4FRBlLfZAG+oPiyieMxzxIsPyUQdFnBYLRVQvJiP:nnppUsH4bBltAno6Ltx2sPLQtYLr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2176	r_server.exe

Loads dropped DLL 11 IoCs

pid	Process
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2176	r_server.exe
2176	r_server.exe
2176	r_server.exe
2176	r_server.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\admdll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\raddrv.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Radmin\raddrv.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\admdll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\help.hlp	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\AdmDll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\help.hlp	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\radmin.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\license.txt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\_ci_gentee_	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\README.TXT	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\WhatsNew.txt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\uninstal.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\help.cnt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\help.cnt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\raddrv.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\radmin.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\README.TXT	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\WhatsNew.txt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\uninstal.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\AdmDll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2176	2552	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\407449f2a326a81163b76b7354cae031_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\r_server.exe
  C:\Windows\system32\r_server.exe /intsetup
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Radmin\AdmDll.dll

Filesize
88KB

MD5
c915181e93fe3d4c41b1963180d3c535

SHA1
f35e66bec967d4254338a120eea8159f29c06a99

SHA256
d8fc5d545e684a4d5001004463f762d190bee478eb3a329f65998bad53d3c958

SHA512
2a5ceeb919546a713e172823da75e8f58c98c1dcedfaa7cacbd48af57bcb8da49c6289908c6c2a1bb6bda4cc7fac58adffae4a500dfe0c503397ca9aa8e92e21

Download Submit
C:\Program Files (x86)\Radmin\r_server.exe

Filesize
236KB

MD5
6a413e4d338fb13e58916e3b8051dbbd

SHA1
e351af195e910c1e49a5bfa9a39b88f40f5c1582

SHA256
b8def2d716ccdf506cfe3a2c8c7fa5743ad3032bc8f3a3a212143096c0f54a9b

SHA512
ac6ec97866c370f0a4ae72176208896a70bb2c80da7fe3b8a97922035b0a47d26f006d4b9858565ec1bcf0051a7db1a9a253e653e80bbd9570f65ad8be0d14cf

Download Submit
C:\Program Files (x86)\Radmin\raddrv.dll

Filesize
28KB

MD5
b50d22ab0323cbd0fedfdf4689bc1301

SHA1
efd6ef059fa6ef25791e7ee660d63b05d0c11963

SHA256
970786caf18ef731b0e1a562e7155c7b7fe525fc000c14a6156ac19292922bc0

SHA512
91961bd7fe9744f56a1dde2123d78db428f3d7c1dd0155458a73e822f3073d5221e95cc4441d824b36b556765660ae781282c3c4d95e3a810abf4ff84c0c5bfc

Download Submit
C:\temp\Default.bmp

Filesize
18KB

MD5
f372b11ff99bffed4cd279c0155adede

SHA1
89cbf60925076e9a14fd48b13790422b43a5b989

SHA256
d9d5e28eb445e7986bdef4d409868af205d525f2f0729427dfe3e33a7251b15d

SHA512
e902f0d7ff0e2af64ce3e8ae6d704ec21b04b35ac3f25a9acd53938b3b66fbaa02b25e816202f165e2d7339b62d2cd6fe9f764d64eefd5b24d1a108cb4b2679f

Download Submit
C:\temp\license.txt

Filesize
2KB

MD5
7019746d6d89effeb872bd2cb5c44b7e

SHA1
84c2a02d28950c8614a7849b3998b2186eb02026

SHA256
6fe7b8b79695f749376812dddbbe0a079445d14295db285583a0ebf3e394457d

SHA512
9f45bc4ba6554a64d539a0b39e2c935ad71e617ce25ec5db5548c1943bde79aadd1f553b404a7c0842bcbc0cb9aa5a9c3b5c07d16fd5b625ad31223cd86a1ab3

Download Submit
\Program Files (x86)\Radmin\radmin.exe

Filesize
1.0MB

MD5
a4fd3c0387f587da36a6838117c7c6b5

SHA1
58c1d35961431449187c0667070d4468a390cc9b

SHA256
4be8a275655de01600be147b9e69db6db8f71acc9bdcbf996611f6fca6e83fcd

SHA512
81f57463b7940745ce0672fb90d574ad069e1ac6463eaddd8695d53a09a6898f8b01413496974d17101de9e3756f037331f25c1f51c78af77fdcae28155f2224

Download Submit
\Program Files (x86)\Radmin\uninstal.exe

Filesize
20KB

MD5
b83429c6f8335b63dd316bb83edaff23

SHA1
e614b5ac3aadc5e83abfc22187b0bc80d47db736

SHA256
d671cb4cee92d70460138cf2a2ee3729a14081327abfff52e267915e5832c41b

SHA512
7b98b0f6da29818ed7d3e5a09fa613db0ff78c940bb96af84a52b09c8ec4329ebc46dd428847bf980c4ae67fe012d7dc3a9f0ecc6a532b0ecbd4aa86a80e4bea

Download Submit
memory/2176-96-0x00000000008E0000-0x000000000094E000-memory.dmp

Filesize
440KB

Download
memory/2552-11-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2552-19-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2552-97-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing