c988b5de0620878a133e5113ce1b64c03bae09d6099c00fb6e248473b92ef371

General

Target

00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Size

408KB
MD5

00982b52825113db51775277e3d7922e
SHA1

c6761b4a32d114cc9a7a54af8c62abad6204430a
SHA256

c988b5de0620878a133e5113ce1b64c03bae09d6099c00fb6e248473b92ef371
SHA512

137b1e63029182e0391ff2cdc38f551862f94db35267178ef4c6418374af45eabde4dfb912ccc2e0dd697996b5e96cc90ed185aef44ee5368f1e200347ef49df
SSDEEP

6144:ZBGp+tWAh22uCjU4aAS8cQiqebgFq5Bs01DgeaIpGbJ9vYPCjr1kG:jCe22FjxaASjTPcLJ9vYyxk

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\lala.exe"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lala.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lala.exe	cmd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	00982b52825113db51775277e3d7922e_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	00982b52825113db51775277e3d7922e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Token: 33	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2368	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	85
PID 1616 wrote to memory of 2368	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	85
PID 1616 wrote to memory of 2368	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	85
PID 1616 wrote to memory of 2408	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	87
PID 1616 wrote to memory of 2408	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	87
PID 1616 wrote to memory of 2408	1616	00982b52825113db51775277e3d7922e_JaffaCakes118.exe	87
PID 2368 wrote to memory of 4544	2368	cmd.exe	88
PID 2368 wrote to memory of 4544	2368	cmd.exe	88
PID 2368 wrote to memory of 4544	2368	cmd.exe	88
PID 4544 wrote to memory of 2328	4544	wscript.exe	89
PID 4544 wrote to memory of 2328	4544	wscript.exe	89
PID 4544 wrote to memory of 2328	4544	wscript.exe	89
PID 2328 wrote to memory of 3000	2328	cmd.exe	91
PID 2328 wrote to memory of 3000	2328	cmd.exe	91
PID 2328 wrote to memory of 3000	2328	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\00982b52825113db51775277e3d7922e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00982b52825113db51775277e3d7922e_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\winhostf\winhost1.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\winhostf\winhostvbs.vbs" "C:\Users\Admin\AppData\Local\Temp\winhostf\winhost2.bat"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\winhostf\winhost2.bat" "
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderName\lala.exe" /f
        5⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:3000
- C:\Users\Admin\AppData\Local\Temp\winhost.exe
  C:\Users\Admin\AppData\Local\Temp\winhost.exe
  2⤵
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winhostf\winhost1.bat

Filesize
75B

MD5
b2a7d63bc47f686e7df8c52200763891

SHA1
a9e6b1abbece47994a68221b3570987c5fa7954b

SHA256
b63308b37e470e32ba4dbc7bfb33051ec973abb4e0daf9ccbd2052a544c09f37

SHA512
773eb61f376162ae44aeb1c61e416ab9f2c622d0bbb6a129d336105149c58444cd43e8703ca0bc8eb246f8c81b4d9432594afbac6adcdf8c77276fe0263e5d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\winhostf\winhost2.bat

Filesize
404B

MD5
3c1dd4e0dc417eeb3af5504b365382ea

SHA1
52e1881ba5be8dbf8d5d46c6f50e0244cce96981

SHA256
132fa95660375d8cac3b2c7abdf0ffe35c453edc22319b1e2b3a0e9c45eed3e1

SHA512
5e5bb226ad3e98945c317dc564e6ebd67a535c7d566bfd5ab78f1d3e50f211a08216c19e0f8777253e3d4b4662c6bd29931e775e13d3245d06c981d51ce4c75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\winhostf\winhostvbs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
memory/1616-0-0x0000000075272000-0x0000000075273000-memory.dmp

Filesize
4KB

Download
memory/1616-1-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1616-2-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1616-19-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads