6055030593980bf8738496471ced440bfe60e388528218203a4ddd021a6d31e6

General

Target

6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
Size

55KB
MD5

6a1256de8bd72812e040a7ad303e0ae2
SHA1

e73a2c261189d6569e3cb0a52d9d51c4c1f904f6
SHA256

6055030593980bf8738496471ced440bfe60e388528218203a4ddd021a6d31e6
SHA512

8fe719ca5b009a825f7fb98c760a1440b8a4ec07b919580caf20f237dfe1d724c54ee909b68bc59373e17990eb1835f0e5ed076f7f782fb238303955e91571b9
SSDEEP

768:sD3tOxn+4NgU2N1JfQM6JVs2E91l1NL1bSZoeU8vhIEAz4Z/jfRz4Z/jf2:v+ugUgFDZN985THZ/CZ/i

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2092	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2832	ysla.exe

Loads dropped DLL 2 IoCs

pid	Process
2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\clokci\2.bak	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
File created	C:\Program Files\Windows NT\clokci\ysla.exe	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows NT\clokci\ysla.exe	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	ysla.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
2832	ysla.exe
2832	ysla.exe
2832	ysla.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2832	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2832	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2832	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2832	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2092	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2092	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2092	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2092	2372	6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a1256de8bd72812e040a7ad303e0ae2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\Windows NT\clokci\ysla.exe
  "C:\Program Files\Windows NT\clokci\ysla.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows NT\clokci\ysla.exe

Filesize
55KB

MD5
6a1256de8bd72812e040a7ad303e0ae2

SHA1
e73a2c261189d6569e3cb0a52d9d51c4c1f904f6

SHA256
6055030593980bf8738496471ced440bfe60e388528218203a4ddd021a6d31e6

SHA512
8fe719ca5b009a825f7fb98c760a1440b8a4ec07b919580caf20f237dfe1d724c54ee909b68bc59373e17990eb1835f0e5ed076f7f782fb238303955e91571b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
199B

MD5
8b99f3661a9b8d20f268eea9053e5ef8

SHA1
f122ebdaf935decb1d2f1450a9459d42fe322143

SHA256
a2128c5e5ef0371f8876326566c3ddfa07a8ac5973423c6c13237c755be549a3

SHA512
d0a7bc513e5a97cf34590913fc30a0b4379d7f846405d47ade685f8f895e6218cc691ff27996437ce201802453f7f87a68ac05b48ace03df2f602dd83aa0faf6

Download Submit
memory/2372-2-0x0000000003CF0000-0x0000000004D52000-memory.dmp

Filesize
16.4MB

Download
memory/2832-18-0x0000000003E40000-0x0000000004EA2000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing