b16b6d5a80cc32b3fce1b398fa4e2e5adf2439630f665befadee3ee4b9f90fe3

General

Target

77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe
Size

278KB
MD5

77f6ed024893f9476d575cdb542d1dfe
SHA1

2b2a7accd397f31be66d616007f1b25c1e6c5649
SHA256

b16b6d5a80cc32b3fce1b398fa4e2e5adf2439630f665befadee3ee4b9f90fe3
SHA512

a6d1994434169886f78379748a36797b40523ffbd7e196f9d677e9dcfdc985f3347b7402e544d9f5f615523543f9a921a180fa8b15fa9902c4c767d9e18a6ff5
SSDEEP

6144:9IJxXDdmC+IkVOje3reitQZVEMyzHIf9i6HSjcdCHuU:WfzdmCmzTtQZfyzoFhyjcdCp

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
persistence privilege_escalation

AppCert DLLs
T1546.009

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

pid	Process
4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe
2244	Process not Found
2972	rundll32.exe
4492	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\cttuEdit64.dll	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cttuEdit.dll	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2084	4492	WerFault.exe	102
4276	4492	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe
4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 2972	4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe	97
PID 4236 wrote to memory of 2972	4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe	97
PID 4236 wrote to memory of 4492	4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe	102
PID 4236 wrote to memory of 4492	4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe	102
PID 4236 wrote to memory of 4492	4236	77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4956	attrib.exe

C:\Users\Admin\AppData\Local\Temp\77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\cttuEdit64.dll",CreateProcessNotify
  2⤵
  - Loads dropped DLL
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240671031.bat" "C:\Users\Admin\AppData\Local\Temp\77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe""
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4492
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\77f6ed024893f9476d575cdb542d1dfe_JaffaCakes118.exe"
    3⤵
    - Views/modifies file attributes
    PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 516
    3⤵
    - Program crash
    PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 524
    3⤵
    - Program crash
    PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4236 -ip 4236
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4492 -ip 4492
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4492 -ip 4492
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Privilege Escalation

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240671031.bat

Filesize
97B

MD5
d226a657b279c5fc0a892748230a56ff

SHA1
fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5

SHA256
9dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761

SHA512
07d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a

Download Submit
C:\Windows\SysWOW64\cttuEdit.dll

Filesize
82KB

MD5
07037af40074119b339ede04f34f3bb7

SHA1
b3f005b28490ab81b31f879b8df655149302c3f2

SHA256
4d547461d8d857d6c7a93eb7ec2aeb2c23f1a38f3442573dab08fe6c5e559b86

SHA512
d2ed8b41608d21d075258945a492ec4d4b86a0628027de15a41bdd08cfab736d5c5748ade25445fd5f969d456233d1e6a336190bdbff72bbead88d3e0616dfd2

Download Submit
C:\Windows\System32\cttuEdit64.dll

Filesize
94KB

MD5
c2871dc1c286179ec5ee0c88f1caddb5

SHA1
698700dd9629f3596d781bfeec92168d5c95d802

SHA256
eca715de225c2e02faf8cd5b3fb97b331028b56d25a45a0f5d719fcdc0baa388

SHA512
c365fa89300ea13c92a697e224a145f72f051f3c8bf311c4242cf26f083cf0c6d35bd40c76baad8b070fe6e5b2ea7fc2751c8d121bfedc22ef270a9325e8ace5

Download Submit
memory/2972-16-0x000001B89F580000-0x000001B89F581000-memory.dmp

Filesize
4KB

Download
memory/4236-7-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/4236-8-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4236-10-0x0000000001000000-0x0000000001048000-memory.dmp

Filesize
288KB

Download
memory/4236-11-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4236-12-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download
memory/4236-1-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download
memory/4236-19-0x0000000001000000-0x0000000001048000-memory.dmp

Filesize
288KB

Download
memory/4236-2-0x0000000001000000-0x0000000001048000-memory.dmp

Filesize
288KB

Download
memory/4492-23-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4492-24-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing