9a6a99e76ce170b6abda7ba6fbe18d492b5276db3ca68ed273de74e5cb564e42

General

Target

4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe
Size

202KB
MD5

4925b9c17c5c0de34eedf258f8f4f374
SHA1

0a66255b71760d6fd467ad48c7be3816e32097c9
SHA256

9a6a99e76ce170b6abda7ba6fbe18d492b5276db3ca68ed273de74e5cb564e42
SHA512

dd49fb95737b42d93cbb3359ceefaa9fcecf3c4c66f22f19207cd513e2184524db666f0641f4896a43b817740b8d40c3c0cb99066d137795f750791be68295aa
SSDEEP

6144:lkaoTSj1byLqohs0g7ltVXPeAayyQqxa1m:UGpbyLLhCJfkyylG

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
persistence privilege_escalation

AppCert DLLs
T1546.009

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

pid	Process
4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe
5068	Process not Found
4584	rundll32.exe
2292	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\backfo32.dll	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\backfo3264.dll	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4112	2292	WerFault.exe	90
3308	2292	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe
4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4584	4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe	86
PID 4744 wrote to memory of 4584	4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe	86
PID 4744 wrote to memory of 2292	4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe	90
PID 4744 wrote to memory of 2292	4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe	90
PID 4744 wrote to memory of 2292	4744	4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2716	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\backfo3264.dll",CreateProcessNotify
  2⤵
  - Loads dropped DLL
  PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240655671.bat" "C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe""
  2⤵
  - Loads dropped DLL
  PID:2292
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\4925b9c17c5c0de34eedf258f8f4f374_JaffaCakes118.exe"
    3⤵
    - Views/modifies file attributes
    PID:2716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 524
    3⤵
    - Program crash
    PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 568
    3⤵
    - Program crash
    PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4744 -ip 4744
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2292 -ip 2292
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2292 -ip 2292
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Privilege Escalation

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240655671.bat

Filesize
97B

MD5
d226a657b279c5fc0a892748230a56ff

SHA1
fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5

SHA256
9dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761

SHA512
07d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a

Download Submit
C:\Windows\SysWOW64\backfo32.dll

Filesize
66KB

MD5
1b779622c0d6eec48ac0c1f3e39eb7b9

SHA1
db01babafb0bbd256dca940cbe3667774e76c80a

SHA256
ff0d559548eb5bcf7ee0368198cd74d2aca13b54dece875080653b677c81508a

SHA512
fc88df2a55dd082a568ade994ea0eaa6a581f94e797fbe3962eaa692e43ac5403b4e817ccc011445643d690022bfbe14f580f39a06b1cab14cbef0d8091c4a34

Download Submit
C:\Windows\System32\backfo3264.dll

Filesize
75KB

MD5
4dab557dad0fb8ec95f66d5efe648b02

SHA1
b52d4d3c8429a132b7582cd8dbe89ec93da3dc05

SHA256
b8a5ae38b6d38327ae2abbeb70dec6ee9ac52cdc421f5585c4907e8088eb3849

SHA512
5dbc616b17578dfb4c620bcca3b040a89b5e771f34053ffe46ff449f0bea5f68f6c7db9eb7d43cddf7de7e34a94aeb29be4c2174bcec3de74a5a09a6bd70afbf

Download Submit
memory/2292-21-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/4584-14-0x000001F80D900000-0x000001F80D901000-memory.dmp

Filesize
4KB

Download
memory/4744-6-0x0000000008AA0000-0x0000000008AA1000-memory.dmp

Filesize
4KB

Download
memory/4744-9-0x0000000001000000-0x0000000001035000-memory.dmp

Filesize
212KB

Download
memory/4744-10-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/4744-7-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/4744-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4744-1-0x0000000001000000-0x0000000001035000-memory.dmp

Filesize
212KB

Download
memory/4744-22-0x0000000001000000-0x0000000001035000-memory.dmp

Filesize
212KB

Download
memory/4744-24-0x0000000001000000-0x0000000001035000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing