e5789d70cecc0a47d8fe57db9afa3c6425dc2765ef69529f4474200394934e5e

General

Target

746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Size

60KB
MD5

746b9e5155240a98d1d748a9a9eae25b
SHA1

7da112336eb3540b769d467bbddbce1ccba316c3
SHA256

e5789d70cecc0a47d8fe57db9afa3c6425dc2765ef69529f4474200394934e5e
SHA512

aeddbca251aaa7ad1359c3d282461c5b7eb1de69773c53e34a27d5f004d58ee77dce23fbf35c35680815063bfaf89745edfa7849613d02e889165a771fe79884
SSDEEP

1536:BU8Cnt9E7sSLOi69qFoc3OBWzr48A+d5CPr/50GmbQnCzw4/XliV:G8cTn+dYWzr48ndUj50GkQCzXfU

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\CelInDriver.sys	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\CelInDrv\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\CelInDriver.sys"	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpdhcp.dll	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpdhcp.dll	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Token: SeDebugPrivilege	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Token: SeDebugPrivilege	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1324	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe	21
PID 2200 wrote to memory of 2596	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe	28
PID 2200 wrote to memory of 2596	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe	28
PID 2200 wrote to memory of 2596	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe	28
PID 2200 wrote to memory of 2596	2200	746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1324
- C:\Users\Admin\AppData\Local\Temp\746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\746b9e5155240a98d1d748a9a9eae25b_JaffaCakes118.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xpdhcp.dll

Filesize
44KB

MD5
0d4d79cd43ea8aa3446c31145391e210

SHA1
7cdfebf7cce7375b872b3facc24a8ffb8378a58d

SHA256
cd5d40c5aba67d6e3326efe4a96d03d1d32097b516db1cfeadabed1fcbfe5006

SHA512
32328a89e9b37b6153a68006e2d6573a1d4d48d5c055d0f1a8f9547208ea42b74a33b1ebc792ac17d99a88f5fe57988e1b93176d1721f708f4ab44f39b32c95d

Download Submit
memory/1324-10-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2200-6-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2200-5-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/2200-4-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2200-2-0x0000000001800000-0x0000000001817000-memory.dmp

Filesize
92KB

Download
memory/2200-16-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.