c02e35aa90a8a5003feb5e830ec7a1eb461e8d2c79dbe8c72419a0fe864719ca

General

Target

6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe
Size

806KB
MD5

6a135c2e3ba5e6655ee27bf60a359e53
SHA1

36713a2c3908567bbf0cd18aa944a522e5d915fc
SHA256

c02e35aa90a8a5003feb5e830ec7a1eb461e8d2c79dbe8c72419a0fe864719ca
SHA512

05ad73463914b584c8b83f2d8e796f596f34c13fe3f6680b617e03b1dfe32cd3e1776e693d4561eaab617228760c3e1d37c49027116cfde5e3386af5ad366033
SSDEEP

12288:1vD+a+J195bR+uSGtZ3pgWKQqnuOHzrV3Dr7Ilnk39yS:17HK5N+cLJKQmHzrV3nMkd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp

Loads dropped DLL 1 IoCs

pid	Process
2412	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LocalHost32 = "C:\\Windows\\system32\\lsasrv.exe"	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lsasrv.exe	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lsasrv.exe	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\tmp_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.tmp	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.tmp\ = "tmp_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\tmp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\tmp_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\tmp_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\tmp_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\tmp_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3024	2412	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe	30
PID 2412 wrote to memory of 3024	2412	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe	30
PID 2412 wrote to memory of 3024	2412	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe	30
PID 2412 wrote to memory of 3024	2412	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe	30
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 3024 wrote to memory of 2060	3024	6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp	31
PID 2060 wrote to memory of 2836	2060	rundll32.exe	33
PID 2060 wrote to memory of 2836	2060	rundll32.exe	33
PID 2060 wrote to memory of 2836	2060	rundll32.exe	33
PID 2060 wrote to memory of 2836	2060	rundll32.exe	33

C:\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp
  C:\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f4e2f72b00aeefeac0d410da85dfdd79

SHA1
8a94d2c60b03494d80bf290b75a6313b0d5cb1d8

SHA256
5080aa329be14974eb856a39b29688fe9e7807d59dd8cd4135160996e3b1ec8f

SHA512
4f7f7e0cf868ffbeb6a1d3d047c18a407626940066fa6e7ee1eabb141cad38a091fcaed8225a66adbf0f1113391fc9c916f384ba612bf2217e53e666130c4c51

Download Submit
\Users\Admin\AppData\Local\Temp\6a135c2e3ba5e6655ee27bf60a359e53_JaffaCakes118.tmp

Filesize
78KB

MD5
17314db5f7c540e7f1fff7b95bfe45da

SHA1
8e0fad151ac7fd342c08fee90c1032efd74206cd

SHA256
d1a09cbc6d215c7aa0448a2cbc1e0eb01b2bdb117920fa4b7feb68a4e97da879

SHA512
2587a76ccd79230fb301a367473a3361eee1019b9cceffe433bdc75b943c30c5bbb6d24d3e87e4e3676db412f2658d526219e736a62b0cced13dd31f97f2809b

Download Submit
memory/2412-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2412-19-0x0000000000400000-0x00000000024BD000-memory.dmp

Filesize
32.7MB

Download
memory/2412-38-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3024-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads