92fceb949c5b1c34aa19377b103439c44a8f61ea4db43173883262ddcd71a5b8

Reason

Machine shutdown

General

Target

7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe
Size

45KB
MD5

7743e85e4aab9c595053d4a605887cfe
SHA1

91c318d180aef4abae035cf5d11705d307caf4d2
SHA256

92fceb949c5b1c34aa19377b103439c44a8f61ea4db43173883262ddcd71a5b8
SHA512

4a1112def84d26c4f42b40d46256f2b9bba2e60ace6f7da2e73f38234b539ed9901c8856bc70556a1fa741c44aede6088cb771a9a7eb3c0f2f2949da5c0cb82e
SSDEEP

768:y3J3kyPnf7zO23G43LLc/2vYPif9Ia3gn+hpJqOcsMVKFGARS+igNz:y3J3ka3/XEfif9PJT1F7FG2S+igNz

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSSMSGS = "rundll32.exe winosk32.rom,yPxRun"	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winosk32.rom	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winosk32.rom	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E4AEE8FE-4E3F-11EF-A092-D2308408FFFF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3092	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3092	iexplore.exe
3092	iexplore.exe
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 772	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	82
PID 4908 wrote to memory of 772	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	82
PID 4908 wrote to memory of 772	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	82
PID 772 wrote to memory of 3092	772	cmd.exe	86
PID 772 wrote to memory of 3092	772	cmd.exe	86
PID 3092 wrote to memory of 1600	3092	iexplore.exe	88
PID 3092 wrote to memory of 1600	3092	iexplore.exe	88
PID 3092 wrote to memory of 1600	3092	iexplore.exe	88
PID 4908 wrote to memory of 3092	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	86
PID 4908 wrote to memory of 3092	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	86
PID 4908 wrote to memory of 3092	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	86
PID 4908 wrote to memory of 3092	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	86
PID 4908 wrote to memory of 4404	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	89
PID 4908 wrote to memory of 4404	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	89
PID 4908 wrote to memory of 4404	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	89
PID 4908 wrote to memory of 3992	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	90
PID 4908 wrote to memory of 3992	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	90
PID 4908 wrote to memory of 3992	4908	7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start iexplore -embedding
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -embedding
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3092 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tweAC2E.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7743e85e4aab9c595053d4a605887cfe_JaffaCakes118.bat

Filesize
267B

MD5
15993c9de2639c5ad35ad2ad8c5c3c89

SHA1
92b469277716e37c3a80ef30ffde3c2091c80f8e

SHA256
fdac54364ff44e44ac29db5b767d3e9007ac7c3dee0d76925ac9530dba5749af

SHA512
ce1615435ce77567dab9c536b9c8eb35e64f87948ad9e24de2d3ca8e68a1a4df4a8d937d669975ce6d9b4da597055377a55551a755657708594915ce4a3dcbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tweAC2E.bat

Filesize
188B

MD5
463647cd0d9c14116f4263db87aebc38

SHA1
d98bdb326ed601ca607645be86e89a8cfabdb491

SHA256
6a96f8e8e46f197245df51ea0ec5cd69aa14a05261bba96f73ea800a916416f7

SHA512
64b6fb80277aedd41e267963ed886ee0c126718dfdc9e3ab74f4f3e5d31054d409654f438ca8e2bdf0cf7fae165a8397a3d03942386c9244e364b4269b785daf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tweAC2E.tmp

Filesize
32KB

MD5
7ac9acb5469776c2f03d943037d47298

SHA1
8f8838c3da0df25c95c6fb50205c427d2afc7543

SHA256
16a9514b509206e55689a8bd6a1edae52987efc8459a021d5cec3b5c54946b15

SHA512
51b168d05103e9439e920e6b1c9b5b817e3e7255b7d18b89d88140311fa9313240037f1449c908c512b5c0b105581895b31a6182f60ced2d6ad396fb67502d3e

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads