b57d4e5ce347cd70089cb4ee66e7756330b6f65c870afaccebdc4cbf512e7e03

General

Target

749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe
Size

269KB
MD5

749d6e169b1b9eb0eccd872fb74cf5d1
SHA1

650c3400402853ac0e781909e20bb31001e79288
SHA256

b57d4e5ce347cd70089cb4ee66e7756330b6f65c870afaccebdc4cbf512e7e03
SHA512

d429f861834b157d9f42191434c4471782974291f701ed9326f460725249da9adb7793fbebd21eb01fd98de912d117b65ec87720b76fccb84e3a192adfd4eb8e
SSDEEP

6144:grEGCkgR0Qq97lDV0Os75EfbPFK5g3mBU5KXB7PDpqjP:uCBCQq5VZ9WgOyKXxPD07

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
persistence privilege_escalation

AppCert DLLs
T1546.009

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1208	Explorer.EXE

Loads dropped DLL 7 IoCs

pid	Process
2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe
2580	rundll32.exe
2580	rundll32.exe
2580	rundll32.exe
2580	rundll32.exe
2804	cmd.exe
2136	attrib.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\Robodctr64.dll	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Robodctr.dll	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2580	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2580	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2580	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2580	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2688 wrote to memory of 2804	2688	749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe	31
PID 2580 wrote to memory of 1208	2580	rundll32.exe	21
PID 2580 wrote to memory of 1208	2580	rundll32.exe	21
PID 2804 wrote to memory of 2136	2804	cmd.exe	33
PID 2804 wrote to memory of 2136	2804	cmd.exe	33
PID 2804 wrote to memory of 2136	2804	cmd.exe	33
PID 2804 wrote to memory of 2136	2804	cmd.exe	33
PID 2804 wrote to memory of 2136	2804	cmd.exe	33
PID 2804 wrote to memory of 2136	2804	cmd.exe	33
PID 2804 wrote to memory of 2136	2804	cmd.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2136	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:1208
- C:\Users\Admin\AppData\Local\Temp\749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\Robodctr64.dll",CreateProcessNotify
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\259478709.bat" "C:\Users\Admin\AppData\Local\Temp\749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe""
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\749d6e169b1b9eb0eccd872fb74cf5d1_JaffaCakes118.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Privilege Escalation

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259478709.bat

Filesize
97B

MD5
d226a657b279c5fc0a892748230a56ff

SHA1
fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5

SHA256
9dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761

SHA512
07d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a

Download Submit
C:\Windows\system32\Robodctr64.dll

Filesize
98KB

MD5
978d60f9f2c3de0caf481bf19c00a62b

SHA1
4dc12cc42a4137d021ae54e913dbf4115fa1d4d4

SHA256
01e8fa633c5f2bbd90974ca5ea43eccd09185e3485e81bf453aa2c6ae052387f

SHA512
a0e4d4c9ad178a85b4e03e1cff450681ae6267a00c34acb17d18f3cf71117ca3b5e09ea538d53666298b6a4a0abfc40c7764aa58235e11a1856f7d132df611cf

Download Submit
\Windows\SysWOW64\Robodctr.dll

Filesize
88KB

MD5
1d14e64b3a5b52a4fda1200a0281cb77

SHA1
18cd9b4d89ac67cc75cfed1c2eb932b64657d063

SHA256
53342480f1cc6ac6ab66e5e18efca40024d260e432db51416d7ed9838857c4ac

SHA512
16d4ce75b6ef294e47ad73b0589d9cb45130f5a56ce77161ea2c00415b6f47738e98c7430b63f68b39ceffd3ae552fb1d362a52fee18f961a94f95311b7460b4

Download Submit
memory/1208-47-0x0000000180000000-0x000000018001E000-memory.dmp

Filesize
120KB

Download
memory/1208-29-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/2136-49-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2580-26-0x0000000180000000-0x000000018001E000-memory.dmp

Filesize
120KB

Download
memory/2580-15-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2688-42-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2688-8-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2688-41-0x0000000001000000-0x0000000001046000-memory.dmp

Filesize
280KB

Download
memory/2688-1-0x0000000000710000-0x0000000000750000-memory.dmp

Filesize
256KB

Download
memory/2688-5-0x0000000001000000-0x0000000001046000-memory.dmp

Filesize
280KB

Download
memory/2688-2-0x0000000001000000-0x0000000001046000-memory.dmp

Filesize
280KB

Download
memory/2804-23-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2804-50-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads