45367afad1ea1661bf615a790cd3938bc3650aba6bde77768829d178c01e0c62

General

Target

a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
Size

1.1MB
MD5

a98e607e0fa5292beacdd048e437118a
SHA1

5da4f586b4209ab5f7d886d523c038bcd40ce3a2
SHA256

45367afad1ea1661bf615a790cd3938bc3650aba6bde77768829d178c01e0c62
SHA512

e4b49fe8b171f2f184c61fcb1e49f2625adc8656d63d80b29c5e3bedba996788ae5ef0d016f5c12764e528e73e94c8a75ee945798ff5626ba2d7963f7f9c6a1b
SSDEEP

24576:rQmXoVTzqRHZLPSCAogOvEGr8XSWvZqhVbvL1PQ6NMCDXsspHEhXU:Mm40tcI8hvZubvLBQ6NMCzpHME

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\Beep.sys	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Beep.sys	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2988	Server.exe
2936	Hacker.com.cn.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Hacker.com.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	Server.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.com.cn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3960EE41-C73D-4BB9-A2A3-119BA7030781}\62-19-2d-e3-8c-94	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3960EE41-C73D-4BB9-A2A3-119BA7030781}\WpadDecision = "0"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3960EE41-C73D-4BB9-A2A3-119BA7030781}\WpadDecisionTime = 804b9cfdeef1da01	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-19-2d-e3-8c-94	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-19-2d-e3-8c-94\WpadDecisionTime = 804b9cfdeef1da01	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-19-2d-e3-8c-94\WpadDecision = "0"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3960EE41-C73D-4BB9-A2A3-119BA7030781}	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3960EE41-C73D-4BB9-A2A3-119BA7030781}\WpadDecisionReason = "1"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3960EE41-C73D-4BB9-A2A3-119BA7030781}\WpadNetworkName = "Network 3"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-19-2d-e3-8c-94\WpadDecisionReason = "1"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Hacker.com.cn.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
Token: SeDebugPrivilege	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
Token: SeDebugPrivilege	2988	Server.exe
Token: SeDebugPrivilege	2936	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2988	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2988	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2988	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2988	2520	a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2864	2936	Hacker.com.cn.exe	32
PID 2936 wrote to memory of 2864	2936	Hacker.com.cn.exe	32
PID 2936 wrote to memory of 2864	2936	Hacker.com.cn.exe	32
PID 2936 wrote to memory of 2864	2936	Hacker.com.cn.exe	32

C:\Users\Admin\AppData\Local\Temp\a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a98e607e0fa5292beacdd048e437118a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
744KB

MD5
17e1f9b9b27972ebe09a44bf9a80e85b

SHA1
cff72b7841f4d6ebaeaac2918720b81c9fd7e5ca

SHA256
367ae74095e983b96d83b9e09298ade5ad6780f5634c161fff61d95bf4bbbc52

SHA512
58c1e510f9e11ad1ce0fa39c2f18017d5dac38b9350d76e91c37f5ff84675797b4d85b1136a87320cebb87943f83b2d85129ba88d278ebe37de6fac435411e1a

Download Submit
memory/2520-14-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2520-44-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/2520-29-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2520-28-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2520-27-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2520-26-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2520-25-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2520-24-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2520-23-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/2520-22-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2520-21-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2520-20-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2520-19-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2520-18-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2520-17-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2520-16-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2520-43-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2520-15-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2520-13-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/2520-12-0x0000000003180000-0x0000000003182000-memory.dmp

Filesize
8KB

Download
memory/2520-11-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2520-10-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/2520-9-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/2520-8-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2520-7-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2520-6-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2520-5-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2520-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2520-3-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2520-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2520-1-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/2520-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2936-51-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2936-55-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2988-50-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing