2e27e349e8d1f9ec51b4a1dacd958b941bdfc0308ad9e68b0037a31b4880bdff

General

Target

407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
Size

1.3MB
MD5

407449f2a326a81163b76b7354cae031
SHA1

fb0f643c5d5e4a030d1228ae64f814a9daa122fd
SHA256

2e27e349e8d1f9ec51b4a1dacd958b941bdfc0308ad9e68b0037a31b4880bdff
SHA512

61d426289f82f34e87a69ea91b959136517e1e5017621e0a886f102831bfb17988a69d66316c1b92a17042bdfcbc68f1f7463b75bf049ea5e6bc1c1aea9fe435
SSDEEP

24576:nnqWpxcFsH4FRBlLfZAG+oPiyieMxzxIsPyUQdFnBYLRVQvJiP:nnppUsH4bBltAno6Ltx2sPLQtYLr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	r_server.exe

Loads dropped DLL 2 IoCs

pid	Process
1612	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
2504	r_server.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\admdll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\raddrv.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Radmin\_ci_gentee_	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\AdmDll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\help.hlp	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\radmin.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\WhatsNew.txt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\uninstal.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\help.hlp	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\raddrv.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\license.txt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\help.cnt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\README.TXT	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\r_server.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\WhatsNew.txt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\uninstal.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\AdmDll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\help.cnt	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\raddrv.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\radmin.exe	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File created	C:\Program Files (x86)\Radmin\README.TXT	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Radmin\admdll.dll	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2504	1612	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	86
PID 1612 wrote to memory of 2504	1612	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	86
PID 1612 wrote to memory of 2504	1612	407449f2a326a81163b76b7354cae031_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\407449f2a326a81163b76b7354cae031_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\407449f2a326a81163b76b7354cae031_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\r_server.exe
  C:\Windows\system32\r_server.exe /intsetup
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Radmin\AdmDll.dll

Filesize
88KB

MD5
c915181e93fe3d4c41b1963180d3c535

SHA1
f35e66bec967d4254338a120eea8159f29c06a99

SHA256
d8fc5d545e684a4d5001004463f762d190bee478eb3a329f65998bad53d3c958

SHA512
2a5ceeb919546a713e172823da75e8f58c98c1dcedfaa7cacbd48af57bcb8da49c6289908c6c2a1bb6bda4cc7fac58adffae4a500dfe0c503397ca9aa8e92e21

Download Submit
C:\Program Files (x86)\Radmin\r_server.exe

Filesize
236KB

MD5
6a413e4d338fb13e58916e3b8051dbbd

SHA1
e351af195e910c1e49a5bfa9a39b88f40f5c1582

SHA256
b8def2d716ccdf506cfe3a2c8c7fa5743ad3032bc8f3a3a212143096c0f54a9b

SHA512
ac6ec97866c370f0a4ae72176208896a70bb2c80da7fe3b8a97922035b0a47d26f006d4b9858565ec1bcf0051a7db1a9a253e653e80bbd9570f65ad8be0d14cf

Download Submit
C:\Program Files (x86)\Radmin\raddrv.dll

Filesize
28KB

MD5
b50d22ab0323cbd0fedfdf4689bc1301

SHA1
efd6ef059fa6ef25791e7ee660d63b05d0c11963

SHA256
970786caf18ef731b0e1a562e7155c7b7fe525fc000c14a6156ac19292922bc0

SHA512
91961bd7fe9744f56a1dde2123d78db428f3d7c1dd0155458a73e822f3073d5221e95cc4441d824b36b556765660ae781282c3c4d95e3a810abf4ff84c0c5bfc

Download Submit
C:\ginstall.dll

Filesize
54KB

MD5
38a9142ba7b74db9a68b3691c970bd89

SHA1
701fc2c3bf6f63b7ca7547f3a2dc1f8f154be16f

SHA256
ed866c7802edc00235bd25aa2ae2ec6658eb8cb74301b930a96ab9ab42ed93a2

SHA512
3e0113d00173fbdec430435a34be8053d7e0c08cf2207414f76350b6dda4793b8fb543f76e9b69512d63fa6b1c49dd393ed9ab7b053634109e55386b08497636

Download Submit
C:\temp\Default.bmp

Filesize
18KB

MD5
f372b11ff99bffed4cd279c0155adede

SHA1
89cbf60925076e9a14fd48b13790422b43a5b989

SHA256
d9d5e28eb445e7986bdef4d409868af205d525f2f0729427dfe3e33a7251b15d

SHA512
e902f0d7ff0e2af64ce3e8ae6d704ec21b04b35ac3f25a9acd53938b3b66fbaa02b25e816202f165e2d7339b62d2cd6fe9f764d64eefd5b24d1a108cb4b2679f

Download Submit
C:\temp\license.txt

Filesize
2KB

MD5
7019746d6d89effeb872bd2cb5c44b7e

SHA1
84c2a02d28950c8614a7849b3998b2186eb02026

SHA256
6fe7b8b79695f749376812dddbbe0a079445d14295db285583a0ebf3e394457d

SHA512
9f45bc4ba6554a64d539a0b39e2c935ad71e617ce25ec5db5548c1943bde79aadd1f553b404a7c0842bcbc0cb9aa5a9c3b5c07d16fd5b625ad31223cd86a1ab3

Download Submit
memory/2504-81-0x00000000006B0000-0x000000000071E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing