147d93096d541cfd1f5ba922c7eb3f114365874bfb6aaa3f886ff51061bcb179

General

Target

8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
Size

988KB
MD5

8444369e0b1bb3745748fc291a36cd56
SHA1

cd20e28e634f848c38a0fe3d78aa519171189675
SHA256

147d93096d541cfd1f5ba922c7eb3f114365874bfb6aaa3f886ff51061bcb179
SHA512

3f1bb1764b419dab82c20c3fa04b64f6bcb40d69691445c2750a35de7e9ae53818fa8f95f0ec6a71f4af98d23975eab51240eab9787dc5c96f368a1c0d615a17
SSDEEP

12288:X36cLlFLuQh9IHEOqeRkgYuIQQoNAHYZ/GEuGjPqR6S+Q7E94hkoBDP8:6cZFLfbLPeu3+QoKCPLqRhndhdDP8

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RUNDLL.EXE

Executes dropped EXE 1 IoCs

pid	Process
3836	RUNDLL.EXE

Loads dropped DLL 2 IoCs

pid	Process
3836	RUNDLL.EXE
3836	RUNDLL.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll = "\"C:\\Users\\Admin\\AppData\\Roaming\\rundll.exe \""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUNDLL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1008	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE
3836	RUNDLL.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3836	RUNDLL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3836	3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	86
PID 3428 wrote to memory of 3836	3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	86
PID 3428 wrote to memory of 3836	3428	8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe	86
PID 3836 wrote to memory of 4112	3836	RUNDLL.EXE	89
PID 3836 wrote to memory of 4112	3836	RUNDLL.EXE	89
PID 3836 wrote to memory of 4112	3836	RUNDLL.EXE	89
PID 4112 wrote to memory of 1028	4112	cmd.exe	91
PID 4112 wrote to memory of 1028	4112	cmd.exe	91
PID 4112 wrote to memory of 1028	4112	cmd.exe	91
PID 1028 wrote to memory of 1008	1028	cmd.exe	92
PID 1028 wrote to memory of 1008	1028	cmd.exe	92
PID 1028 wrote to memory of 1008	1028	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8444369e0b1bb3745748fc291a36cd56_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Roaming\RUNDLL.EXE
  "C:\Users\Admin\AppData\Roaming\RUNDLL.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"C:\Users\Admin\AppData\Roaming\rundll.exe \"" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"C:\Users\Admin\AppData\Roaming\rundll.exe \"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\run.bat

Filesize
145B

MD5
6b8393408a3f2df19ff1e68a4f720729

SHA1
03cbc980dd47a33bdfa18be80cbd3efdbbaf95c6

SHA256
623fecae412449f60ffd8f38862e73504124afb0754952a45103daff0de5a7c9

SHA512
235e3c1f0074282c8cd8d6d9b6dc0c71ae591f5ca6a2f2248f832359a1a452cfce26b5f80fddc5acd5aae811630441b640212b9b7a885f2d69e67813d8d846ca

Download Submit
C:\Users\Admin\AppData\Roaming\ntldr.dll

Filesize
237KB

MD5
2ba6c23dbf19a43f2ade1cc7d4b5cc13

SHA1
d9af6867a85ed239ee946840cc1d15835a6a2b72

SHA256
63d5571e0f271ccd416584640da1426e5e860911bcd1678a69a23b3b41e9902b

SHA512
5e1a3b0d902462ee24ea1e0f2f4b8e720a15f0bb5b99ff54548c0e735014a4b5e9398f75f7827f19cfd3a402ac08b3ef1e85dfd9c07401a2160d049710cf8917

Download Submit
C:\Users\Admin\AppData\Roaming\rundll.exe

Filesize
355KB

MD5
181591d6f546cabe649550ef3f5a9ac8

SHA1
0fd66e923761998780f49ce57e025408fcc3d089

SHA256
de084ea706a6b07f9bf1114b3d84f6f16b1427f2e082feb06fafb6045b4deaed

SHA512
617fd7ae89323a8dd3f9ee937d213742076557024f532d4e4ef284d436bd5bcfe87533441eaafa0cf23f1eaf9c0cb5e3a9682b8675a9e97fa4a8ff82c9900749

Download Submit
memory/3428-9-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/3836-13-0x00000000008E0000-0x0000000000921000-memory.dmp

Filesize
260KB

Download
memory/3836-18-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3836-19-0x00000000008E0000-0x0000000000921000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads