903b8f25efa5c67dab601ea852fe5ae5724238845ad7a923ed1a4550a10f6a13

General

Target

872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
Size

440KB
MD5

872529dda3c8c6ba8430529ba2f24564
SHA1

8f4f056d3a4ba3eb50cb3a7eb7c2705ecd106a0c
SHA256

903b8f25efa5c67dab601ea852fe5ae5724238845ad7a923ed1a4550a10f6a13
SHA512

502ef80a3247b484298879187e33806ded1edf0ddbada5333b81a569c7b248c7d3e2163c83579f81adead1530d347f52703fcca4984d78c513ca3868050b45a2
SSDEEP

12288:Tn0e123y2c8+0eoktq+CAXD0Ed+z/woO:Tn0e12i2caIq+CAT0v0

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2076	dfrgsnapnt.exe
2752	wscsvc32.exe

Loads dropped DLL 5 IoCs

pid	Process
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfrgsnapnt.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dfrgsnapnt.exe"	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfrgsnapnt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscsvc32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	wscsvc32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe
2076	dfrgsnapnt.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2752	wscsvc32.exe
2752	wscsvc32.exe
2752	wscsvc32.exe
2752	wscsvc32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2076	1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe	30
PID 1308 wrote to memory of 2076	1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe	30
PID 1308 wrote to memory of 2076	1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe	30
PID 1308 wrote to memory of 2076	1308	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2752	2076	dfrgsnapnt.exe	33
PID 2076 wrote to memory of 2752	2076	dfrgsnapnt.exe	33
PID 2076 wrote to memory of 2752	2076	dfrgsnapnt.exe	33
PID 2076 wrote to memory of 2752	2076	dfrgsnapnt.exe	33

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	dfrgsnapnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	dfrgsnapnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscsvc32.exe

C:\Users\Admin\AppData\Local\Temp\872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\872529dda3c8c6ba8430529ba2f24564_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1308
- C:\Users\Admin\AppData\Local\Temp\dfrgsnapnt.exe
  "C:\Users\Admin\AppData\Local\Temp\dfrgsnapnt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\wscsvc32.exe
    C:\Users\Admin\AppData\Local\Temp\wscsvc32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dfrgsnapnt.exe

Filesize
440KB

MD5
872529dda3c8c6ba8430529ba2f24564

SHA1
8f4f056d3a4ba3eb50cb3a7eb7c2705ecd106a0c

SHA256
903b8f25efa5c67dab601ea852fe5ae5724238845ad7a923ed1a4550a10f6a13

SHA512
502ef80a3247b484298879187e33806ded1edf0ddbada5333b81a569c7b248c7d3e2163c83579f81adead1530d347f52703fcca4984d78c513ca3868050b45a2

Download Submit
\Users\Admin\AppData\Local\Temp\eapp32hst.dll

Filesize
332KB

MD5
5d905032d3e396a1ae0956790b097d29

SHA1
2651a767078bd1091553b95b6d9ed9d3021267ef

SHA256
660aa5299a42f3cd7a114e57e979633f7dc1d275ffdf66022b4a689d554bad52

SHA512
0fa7f95dd4e4861c8231e8d10cac70a4a4146bdc6d0a72b35c566df1f1be8505d5066921d0af2cd0329c1d0e9e0dd57da52cb6f5c1093007c0e04b264c4fe0ed

Download Submit
\Users\Admin\AppData\Local\Temp\wscsvc32.exe

Filesize
279KB

MD5
672be53e2245341f01d8144fc403a0bc

SHA1
7c56962f6891181300f1cd4431456c2a73e1dff9

SHA256
02d8af9528126544d1766cae164069f4599864da3093abad8a6525007187e0b4

SHA512
bb9c76a06ca02acb830bb280cbbf9ec5d6d0fdc7f97e13591d8426d71cb91f8798b1303d36099cd635160640f2ceb9d2fad47c8fb5a19468ff8ba2900f819af7

Download Submit
memory/1308-0-0x0000000000400000-0x0000000000473400-memory.dmp

Filesize
461KB

Download
memory/1308-10-0x0000000000400000-0x0000000000473400-memory.dmp

Filesize
461KB

Download
memory/2076-37-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download
memory/2076-55-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download
memory/2076-63-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download
memory/2076-72-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download
memory/2752-23-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download
memory/2752-40-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download
memory/2752-49-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download
memory/2752-53-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download
memory/2752-64-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download
memory/2752-73-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads