147d93096d541cfd1f5ba922c7eb3f114365874bfb6aaa3f886ff51061bcb179

General

Target

8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
Size

988KB
MD5

8444369e0b1bb3745748fc291a36cd56
SHA1

cd20e28e634f848c38a0fe3d78aa519171189675
SHA256

147d93096d541cfd1f5ba922c7eb3f114365874bfb6aaa3f886ff51061bcb179
SHA512

3f1bb1764b419dab82c20c3fa04b64f6bcb40d69691445c2750a35de7e9ae53818fa8f95f0ec6a71f4af98d23975eab51240eab9787dc5c96f368a1c0d615a17
SSDEEP

12288:X36cLlFLuQh9IHEOqeRkgYuIQQoNAHYZ/GEuGjPqR6S+Q7E94hkoBDP8:6cZFLfbLPeu3+QoKCPLqRhndhdDP8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2584	RUNDLL.EXE

Loads dropped DLL 3 IoCs

pid	Process
2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
2584	RUNDLL.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll = "\"C:\\Users\\Admin\\AppData\\Roaming\\rundll.exe \""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUNDLL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2888	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
2584	RUNDLL.EXE
2584	RUNDLL.EXE
2584	RUNDLL.EXE
2584	RUNDLL.EXE
2584	RUNDLL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	RUNDLL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2584	2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2584	2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2584	2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2584	2220	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2892	2584	RUNDLL.EXE	31
PID 2584 wrote to memory of 2892	2584	RUNDLL.EXE	31
PID 2584 wrote to memory of 2892	2584	RUNDLL.EXE	31
PID 2584 wrote to memory of 2892	2584	RUNDLL.EXE	31
PID 2892 wrote to memory of 2920	2892	cmd.exe	33
PID 2892 wrote to memory of 2920	2892	cmd.exe	33
PID 2892 wrote to memory of 2920	2892	cmd.exe	33
PID 2892 wrote to memory of 2920	2892	cmd.exe	33
PID 2920 wrote to memory of 2888	2920	cmd.exe	34
PID 2920 wrote to memory of 2888	2920	cmd.exe	34
PID 2920 wrote to memory of 2888	2920	cmd.exe	34
PID 2920 wrote to memory of 2888	2920	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Roaming\RUNDLL.EXE
  "C:\Users\Admin\AppData\Roaming\RUNDLL.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"C:\Users\Admin\AppData\Roaming\rundll.exe \"" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"C:\Users\Admin\AppData\Roaming\rundll.exe \"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\run.bat

Filesize
145B

MD5
6b8393408a3f2df19ff1e68a4f720729

SHA1
03cbc980dd47a33bdfa18be80cbd3efdbbaf95c6

SHA256
623fecae412449f60ffd8f38862e73504124afb0754952a45103daff0de5a7c9

SHA512
235e3c1f0074282c8cd8d6d9b6dc0c71ae591f5ca6a2f2248f832359a1a452cfce26b5f80fddc5acd5aae811630441b640212b9b7a885f2d69e67813d8d846ca

Download Submit
C:\Users\Admin\AppData\Roaming\ntldr.dll

Filesize
237KB

MD5
2ba6c23dbf19a43f2ade1cc7d4b5cc13

SHA1
d9af6867a85ed239ee946840cc1d15835a6a2b72

SHA256
63d5571e0f271ccd416584640da1426e5e860911bcd1678a69a23b3b41e9902b

SHA512
5e1a3b0d902462ee24ea1e0f2f4b8e720a15f0bb5b99ff54548c0e735014a4b5e9398f75f7827f19cfd3a402ac08b3ef1e85dfd9c07401a2160d049710cf8917

Download Submit
C:\Users\Admin\AppData\Roaming\rundll.exe

Filesize
355KB

MD5
181591d6f546cabe649550ef3f5a9ac8

SHA1
0fd66e923761998780f49ce57e025408fcc3d089

SHA256
de084ea706a6b07f9bf1114b3d84f6f16b1427f2e082feb06fafb6045b4deaed

SHA512
617fd7ae89323a8dd3f9ee937d213742076557024f532d4e4ef284d436bd5bcfe87533441eaafa0cf23f1eaf9c0cb5e3a9682b8675a9e97fa4a8ff82c9900749

Download Submit
memory/2220-9-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2584-13-0x0000000000220000-0x0000000000261000-memory.dmp

Filesize
260KB

Download
memory/2584-23-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2584-24-0x0000000000220000-0x0000000000261000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads