d440f435458726015234a23f043a2055a6a7901f04a5129940aebf6ad47ec904

General

Target

a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
Size

15KB
MD5

a4d606632503df5a2f842e3ed38b307f
SHA1

b5b574343ee8306b3be22f614f6b1d294d388740
SHA256

d440f435458726015234a23f043a2055a6a7901f04a5129940aebf6ad47ec904
SHA512

033963c96a817742fac239a2ace563297e59d9897a02b6d65a71268e1e935528c05bd153d0c4fad3b3ec0791d1168b9a2eb181415d0eb2d5e5f561183f1f0eee
SSDEEP

384:XCCoJcG+CDGwFBgZh3u8SlFTQ90zaU7O0DcphNm+ox:yCoJkCtFB+w8Sl6m2GO7hm+ox

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\csmm.exe"	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\csmm.exe"	csmm.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3704	csmm.exe
4748	csmm.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\csmm.exe	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\csmm.exe	csmm.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\jsf.exe	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csmm.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1144	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
3704	csmm.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1144	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
3704	csmm.exe
4748	csmm.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3704	1144	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe	87
PID 1144 wrote to memory of 3704	1144	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe	87
PID 1144 wrote to memory of 3704	1144	a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe	87
PID 3704 wrote to memory of 4748	3704	csmm.exe	89
PID 3704 wrote to memory of 4748	3704	csmm.exe	89
PID 3704 wrote to memory of 4748	3704	csmm.exe	89

C:\Users\Admin\AppData\Local\Temp\a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4d606632503df5a2f842e3ed38b307f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\csmm.exe
  C:\Windows\system32\csmm.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\csmm.exe
    C:\Windows\system32\csmm.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\csmm.exe

Filesize
15KB

MD5
1d358a48b74f592fa7620c347e4836f9

SHA1
b4bae2fb8a91090771275b20697eca4caf97d456

SHA256
4888ad1c1e5472b16bc964685b42a35fb1d7212b97a0ccb54ca1467a4b244d68

SHA512
8e84e35226fe2199629fea9df5a60c3648f83cf09f5bd178d3ef3de3dca3cb7ab2482dce2a01fd248f298130dac5ebf9c18633e41a1c40233abe6fb48278a548

Download Submit
C:\Windows\jsf.exe

Filesize
844KB

MD5
14cbaf8a88a535e1fc47c814c69e33a5

SHA1
7b18dce24ca43478e4dde98a4dc7b9891a3795e9

SHA256
51b2555139bfd7bec352b6fa5fc5b93b9389c2b11c57a9d87c7c514cc45d8e11

SHA512
7495e7387a813ca7ee45b9626bec61a23019dca1a115e16a7ce74ac58c09b5ca193c2dcf80db14b39a3c3f190d09a442d5c9eec4b64375dcfa7ad0fe09c57684

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads