ccd64b2829e63ed69e3e86a4a6afd9b98f35ebc9e3d99800635256d1c561c296

General

Target

69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
Size

185KB
MD5

69ca379ff6de7882aece7ab1bbfb3b20
SHA1

8f2e847c9c021af22055af097dd8bfe465a53623
SHA256

ccd64b2829e63ed69e3e86a4a6afd9b98f35ebc9e3d99800635256d1c561c296
SHA512

692e27bdfd3026ddbd4ad1a4d4600d5596b919d1cff6d3d97eea9d9fce297c7647abced87f423452d6186016bfce53e1412308c4c2ec1066375febf03a9798d4
SSDEEP

3072:pv9sMmpaNYl23k3Lt1lw5t2iLHPe1MBa8BOHOfDhLIs0/hAwNSmkiePIU4LUmea:oM916t7twH+i0HOlIs0ZfNSpiV

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2808	dplaysvr.exe

Loads dropped DLL 3 IoCs

pid	Process
2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
2808	dplaysvr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dplaysvr = "C:\\Users\\Admin\\AppData\\Local\\dplaysvr.exe"	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\dplaysvr = "C:\\Users\\Admin\\AppData\\Local\\dplaysvr.exe"	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dplaysvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
2808	dplaysvr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2808	2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2808	2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2808	2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2808	2476	69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\dplaysvr.exe
  "C:\Users\Admin\AppData\Local\dplaysvr.exe" C:\Users\Admin\AppData\Local\Temp\69ca379ff6de7882aece7ab1bbfb3b20_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2808

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- System Location Discovery: System Language Discovery
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1268.tmp

Filesize
75KB

MD5
ccb5c5fbc620b1e4d95e699a9b835aa9

SHA1
4ed4c65a121aeee6ea9cf5fbfe5ba82d973ac1c3

SHA256
9fa77425db8cfb8c79f5897ac063dca274113180b5186a478cf42ac8bf8b0701

SHA512
563c50e699a6ca296dad922fcfc3b844c62cd34f122c3d45009bda1d5641821646d7bd52b5691684d7a19a60f1b778175b84d738c6772eb8c3985595bd82b5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1269.tmp

Filesize
134KB

MD5
b5b5688ba57006b1e19f0fc0466945aa

SHA1
d9881bf65456beffa0ef79217c67581369e09802

SHA256
4a9631cd73070c0b62f1f382138c5b7c82ac20362393291af0489cd324b2a859

SHA512
68e71d453966def159b11e3ee17d9af01723a38831d1a14c72f49839795bdf9715c2be83d417580f489cd34003399652f6507b3f5bfdb9fb4564acd717da8e32

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
884B

MD5
3f253fe947a011accd9a408946847f77

SHA1
2259c21e88c6d7df69567a058735f1fff6a730a4

SHA256
9d929dca2acd44f2382311e318a21b6df0ef8fac07262814ba3c1fca29da584b

SHA512
cfc0b2a05264100aa7b176d68adba67ddb98937f2e62a6c3033524d97e22190588ea4116c134191d6d889d9b2efee60b11e9fafb6a2216fb7e8fedd0fd9f1415

Download Submit
memory/2476-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2476-3-0x00000000002D0000-0x0000000000301000-memory.dmp

Filesize
196KB

Download
memory/2476-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2476-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2808-22-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads