52074ffa2beddc543065364dc0b59dc60194d2e636df9dbfb0394b7cf514e7e8

General

Target

a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
Size

487KB
MD5

a4aac6c19aaf489a1292b85323ed2a5d
SHA1

acdc8881df02bcbf6e5f1ffe070f905101ec101d
SHA256

52074ffa2beddc543065364dc0b59dc60194d2e636df9dbfb0394b7cf514e7e8
SHA512

3333c4f0484b93a800c811154fd9d941440488da9a2e58d33a5a9b318f5ca596efd5f8ce2c1e02960f68b363dc3e6311fd94bb0b00f39c68a127de21a37e5e33
SSDEEP

6144:Z/66ZmCUexQqTjoOYSl8zTE7W+SYd7M8OmLAyTbxJm4/Icmg2m7MSd9bGx0wxHNa:Z/A0TE7IMsStm7QRe5K0wxqwe

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\Intel Physical Address Aventis 1.3	wciactrl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\Intel Physical Address Aventis 1.3\StubPath = "C:\\Windows\\wciactrl.exe"	wciactrl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\Intel Physical Address Aventis 1.3	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\Intel Physical Address Aventis 1.3\StubPath = "C:\\Windows\\wciactrl.exe"	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2576	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2668	wciactrl.exe
2568	wciactrl.exe

Loads dropped DLL 1 IoCs

pid	Process
2568	wciactrl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel Physical Address Aventis 1.3 = "C:\\Windows\\wciactrl.exe"	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Intel Physical Address Aventis 1.3 = "C:\\Windows\\wciactrl.exe"	wciactrl.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\frnscli32.dll	wciactrl.exe
File created	C:\Windows\SysWOW64\txsocm32.dll	wciactrl.exe
File opened for modification	C:\Windows\SysWOW64\txsocm32.dll	wciactrl.exe
File created	C:\Windows\SysWOW64\frnscli32.dll	wciactrl.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2400 set thread context of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 2668 set thread context of 2568	2668	wciactrl.exe	33

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wciactrl.exe	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wciactrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wciactrl.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2568	wciactrl.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1680	2400	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2668	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2668	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2668	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2668	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	32
PID 2668 wrote to memory of 2568	2668	wciactrl.exe	33
PID 2668 wrote to memory of 2568	2668	wciactrl.exe	33
PID 2668 wrote to memory of 2568	2668	wciactrl.exe	33
PID 2668 wrote to memory of 2568	2668	wciactrl.exe	33
PID 2668 wrote to memory of 2568	2668	wciactrl.exe	33
PID 2668 wrote to memory of 2568	2668	wciactrl.exe	33
PID 1680 wrote to memory of 2576	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2576	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2576	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2576	1680	a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe	34
PID 2568 wrote to memory of 1200	2568	wciactrl.exe	21
PID 2568 wrote to memory of 2880	2568	wciactrl.exe	36
PID 2568 wrote to memory of 2880	2568	wciactrl.exe	36
PID 2568 wrote to memory of 2880	2568	wciactrl.exe	36
PID 2568 wrote to memory of 2880	2568	wciactrl.exe	36
PID 2568 wrote to memory of 2880	2568	wciactrl.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\a4aac6c19aaf489a1292b85323ed2a5d_JaffaCakes118.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\wciactrl.exe
      "C:\Windows\wciactrl.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Windows\wciactrl.exe
        
        C:\Windows\wciactrl.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\~tmE72.tmp.bat" "
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~tmE72.tmp.bat

Filesize
138B

MD5
c0e583c51a13abede479a5bc86358e55

SHA1
523e87abbb0713e5f26c6e3d7b61af8d30df5e87

SHA256
9f8a9b4247c911527a0fb4c2fe25ce03eb3f50e98c0e08c068936d0c4db896fa

SHA512
f8b78f9ccda4d55a640d31ea519ede7dcf37b89e74a7372562754c8a89e080ba5c578da65543f485da8fda56876bc2e8556031c224bd7c9e9e35ee198aad5987

Download Submit
C:\Windows\wciactrl.exe

Filesize
487KB

MD5
a4aac6c19aaf489a1292b85323ed2a5d

SHA1
acdc8881df02bcbf6e5f1ffe070f905101ec101d

SHA256
52074ffa2beddc543065364dc0b59dc60194d2e636df9dbfb0394b7cf514e7e8

SHA512
3333c4f0484b93a800c811154fd9d941440488da9a2e58d33a5a9b318f5ca596efd5f8ce2c1e02960f68b363dc3e6311fd94bb0b00f39c68a127de21a37e5e33

Download Submit
\Windows\SysWOW64\txsocm32.dll

Filesize
158KB

MD5
38b81338ac5b81eead99dbbd12c3efb5

SHA1
b40a64280bf71224438fcc03a0c05df82fd4cc91

SHA256
d1219b3472c11bb2d72dfecbd75b5ad9bce79126912823e55a17d0144fe1933f

SHA512
08a31e1adab27c05b984da214d3df7837084ad4399a99501c4b861bb5733af733498ad990fc0f86271c393ea2f70163fc90d16d94070cc0f11bca3335ba7f3e6

Download Submit
memory/1200-50-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1680-23-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-9-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-4-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-8-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1680-7-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-46-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2400-5-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2568-38-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2568-29-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2568-33-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2568-56-0x0000000013100000-0x0000000013153000-memory.dmp

Filesize
332KB

Download
memory/2568-57-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2668-30-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads