16688f6b48ee349c4e8e764b1d53f549b49dc90860bf479e74c61621a3e102ea

General

Target

750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
Size

13KB
MD5

750d34e8406a3c3cc120d3f3a98893a3
SHA1

8a0acf505cf8269fd31fe5b81626c3f6a7f2c9f5
SHA256

16688f6b48ee349c4e8e764b1d53f549b49dc90860bf479e74c61621a3e102ea
SHA512

1b52049622cda4763e749020a97591ee9d5ee9b283beef57eeebdcf9b3c72c983898d94ae49bc90af4574673d00f91ee7ad329f99f41f82b5486b78b7251ad40
SSDEEP

192:6mdkLvVX1RhDU78PTxGvMHO+poYIEJM/73n9GdR+Y4v/P3XayRM6CHgMUjilN5hL:6md8RSOxu+PM/J2T4vJd8g5jilWK

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\slbiopfs2.dll = "{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}"	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2808	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\slbiopfs2.tmp	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\slbiopfs2.tmp	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\slbiopfs2.nls	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}\InProcServer32	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}\InProcServer32\ = "C:\\Windows\\SysWow64\\slbiopfs2.dll"	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}\InProcServer32\ThreadingModel = "Apartment"	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2808	2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2808	2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2808	2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2808	2292	750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\750d34e8406a3c3cc120d3f3a98893a3_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\78C8.tmp.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\78C8.tmp.bat

Filesize
207B

MD5
b3064acdb54c7e7f3c7f692375ca76f7

SHA1
ed71f1618c668837d48a2e13e637a9e3508f785e

SHA256
7c3323e5ed617b08159e41e8bb4838d0c5590bc22e881f718d9baa6a064c27e5

SHA512
8dce10d61d42585252dd145b4c0371fdcd0e316ab6d3fb8073bbce7a754c08e29e35d8addb5cb53de708b42d8d4ec83d0679b2d6f6ce5a6582fd56d36b9bc134

Download Submit
C:\Windows\SysWOW64\slbiopfs2.nls

Filesize
428B

MD5
238a587ef92e9f7a866fec96ea81bc4b

SHA1
6073e8e41fb52661c5f980621a5519a4b304764a

SHA256
1cb278303deb4c1d41e686cdb801cb99571c9016d2c0136453ebdddd928fc4a1

SHA512
83bcdeec56cb90a45a948fcef8d0aea6c71f100cd944ba7a3457f26fb97c2640aafe18e091fcb4ee7e79f196590d606eb3e37ed5e8d8e7056c2ea95d35a77b61

Download Submit
C:\Windows\SysWOW64\slbiopfs2.tmp

Filesize
795KB

MD5
32efb92b2a67eb9bf3d71ff798804a7f

SHA1
1e254fcafddaf0aac46ad5be0d73629c0f71fe9d

SHA256
b91785bdb345722d19cda96e6fc2644c8d885b5be15e44f08cc26a55fdf7236e

SHA512
21771cc30aed082d52642ff7f614b09c4ec8d900336bb6a78324f4118878ee1f299f77874c7f18d752c6ab38ef1d22eacb136e62f93f1e288292b7d92cbad2a6

Download Submit
memory/2292-16-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download
memory/2292-25-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads