bc856188ca503bdadd66f34308b539cca1715150a28f10c96147572deb7d7eb5

General

Target

5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
Size

1.5MB
MD5

5b339b375ad776be45ea0e9cee4998fd
SHA1

376a8602a39b6727ab628bd38c8086de07c449e4
SHA256

bc856188ca503bdadd66f34308b539cca1715150a28f10c96147572deb7d7eb5
SHA512

760550906f78e872a8cfdb992193c380b448e3e5f1125873654403fb6df680eeba4ceb5da1d7684ea151a81f2d5296f421057b42ccd974b976a32d6393e1adee
SSDEEP

24576:9RBTzDKXNRo3ff6bik+K5E41D3xwLrzSZhWAQTlIRm2:ndPcsGCA1wyaTeF

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xiaofei.dll	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2052	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
2052	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
2052	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
2052	5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b339b375ad776be45ea0e9cee4998fd_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43a6338477a23ee031fa7796ffc988d6

SHA1
2d15bb8206881eb45b0453b27fda7bf14616a668

SHA256
aba613f069af9b2af2c9f0fc4590796a3ec03945798ac172cea9931cda06e2d6

SHA512
b6fcf777dc7ce9468dc6189f4e92bef4dd1ec6f73a584f5fd12d10bc9c6260d647bdce11b87f71911178d889cce9f110f482947ce19ae1cabec0a527ed6899fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d63c67303095e616cf58522e0e3ebe04

SHA1
1f84d009c8beaf513e01cd41408f649912802621

SHA256
d956dd2c032988eb088b34e54091d677b08f4247ab2d7e341a4e8d2481987721

SHA512
983dce10e2abab221932a36a42b314bc084fe263d04d34490b5ae98335a51f1bd1ab16eba7363b53b89e1562745cbe8a238ad1aa363a29c613ae1d0bd52ae5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f9ea4706cb1711f46b92e04d712d42b

SHA1
4a994f8aeaac74398bb6d2d9e00b38097250118a

SHA256
fd63f8c4f676193a605ebedb1f2f248e7996d14452cb0a67a33934f91ee62417

SHA512
88595d7e0d8e8b86eb4470d7724f658c9d4497b931e6256eb484d106ba7f7a5886fc1c52bacfdc8c673d62d37bd7fdcce013e6676b44ed29301fc0b05acef291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdbb62ebc07f8a43bdd7640371aa79a9

SHA1
d76115b2ce7631a5ab724b4f28df14094be4ad87

SHA256
f8173a9a18d437c5dbafb1e03e796d7dfe3eb793d999a961881c64024d52ea52

SHA512
c45223c19d39142e798bc057141716dbf199eecae8e68815b4782e741dd9108a62144abd6b3b65b6b246606ab9d17f88996d66bb3fc9076027fbae61bd9c21a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a42829de4a39d60f896bc7026f6f13

SHA1
3dda243005e412287920a8b8a466d45042868e10

SHA256
3cb644a8ee20478ca28bc92ca39dd5100f36e6c518b648d28984f62c83fa78c5

SHA512
0d2d47e1c657e5ed18f2cc2a2bdd0f84a249a183b4c6c54c2d65fef6cb0c261759dbe07ca7229f87a47b7ad961016f9b8d9ba2aec5c08ae444d28136901f75a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD0D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD37A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads