347577f6568889b7cf402b6e34ef7b66f30c2b1bef329477d547b6117da2c0a2

General

Target

a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
Size

12KB
MD5

a890fa29c70d70f7c5791902e31195a9
SHA1

c4ac33d0e52b14d1582bb64f69e7b8541aa6491d
SHA256

347577f6568889b7cf402b6e34ef7b66f30c2b1bef329477d547b6117da2c0a2
SHA512

041b7a752401faaa31cf2760675f4025581528cc5b7cf2a097786a1001fd293409b63a0e89a35bafd44910ea39d554cb1d8a947961411e2c3218d3c37184c00c
SSDEEP

384:cSETnMZr9Z1pq3Yh/nw3VNeSIF/99aUtX0om:cSmMZxd5SItpQ

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kbdswjr.dll = "{432BDC7C-DE5B-43f4-AA81-E7F8AFB0182D}"	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2804	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kbdswjr.tmp	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kbdswjr.tmp	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kbdswjr.nls	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{432BDC7C-DE5B-43f4-AA81-E7F8AFB0182D}	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{432BDC7C-DE5B-43f4-AA81-E7F8AFB0182D}\InProcServer32	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{432BDC7C-DE5B-43f4-AA81-E7F8AFB0182D}\InProcServer32\ = "C:\\Windows\\SysWow64\\kbdswjr.dll"	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{432BDC7C-DE5B-43f4-AA81-E7F8AFB0182D}\InProcServer32\ThreadingModel = "Apartment"	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2804	1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2804	1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2804	1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe	31
PID 1736 wrote to memory of 2804	1736	a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a890fa29c70d70f7c5791902e31195a9_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\4672.tmp.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4672.tmp.bat

Filesize
207B

MD5
ea28c3bcf9b11789dc211dcb79a5d705

SHA1
2bfa0cb0c1d7d2d22b39f3a9dfed13a95e0ea6d9

SHA256
cdcf54884ec194aaa05e45e268ce813d4bd03876377da2e17ef6a6e16779838c

SHA512
3275eca28853bd04a16c7dd2e25cd89e0164388cc78b43a788dc20a071c696e28c2d2e40fa02618c7fcb4aa46cbf09b5bd83c9bc0db4be39718ab91dec3bfcda

Download Submit
C:\Windows\SysWOW64\kbdswjr.dll

Filesize
742KB

MD5
7344410e17a1554799717af17a1dd974

SHA1
2c8b42f09152a9133355c1934ed839fad42bcc27

SHA256
0eb514f378583685484021150bf50a34adbee1ac77009520d105b5cae5984362

SHA512
53260b2bf81fff401ced51bd0aa87138f475f30690c5f5ab8048e6574a9e5ec7c7f11985b2b99e0d4e73f80863488423c560d920a96409a1a67b9f7b36b199c0

Download Submit
memory/1736-12-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download
memory/1736-21-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads