89fa499b45546a9a9e71a5cafc9c743decc52dab52139ed0c08182a9f450cbbb

General

Target

b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
Size

39KB
MD5

b122a3a8578ecdf75a6343441e1e804d
SHA1

761e0c91c9bcfff977f0bc61b78d1a0278134868
SHA256

89fa499b45546a9a9e71a5cafc9c743decc52dab52139ed0c08182a9f450cbbb
SHA512

72a7c2e781359979051ea41ae5e3980c425e856e627c91a2cf59f7b99f1c91d2bb6ade0214a66238344d5a6e9718a093cadf6e69dea67a86506394eb661ad9bb
SSDEEP

768:nM9DFuNKOXaT+Mo8GPM6vBLI+3TjmmxdmGQX6QugeVJp4zJ8Q:M9UNKOBtMc5/O2mGQXV2VJpwqQ

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 5 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\msinn.exe"	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	msinn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	msinn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\msinn.exe"	msinn.exe

Deletes itself 1 IoCs

pid	Process
2916	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2884	msinn.exe

Loads dropped DLL 2 IoCs

pid	Process
2916	cmd.exe
2916	cmd.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	msinn.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msinn.exe	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msinn.exe	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msinn.exe	msinn.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msinn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2916	2928	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe	30
PID 2928 wrote to memory of 2916	2928	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe	30
PID 2928 wrote to memory of 2916	2928	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe	30
PID 2928 wrote to memory of 2916	2928	b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2884	2916	cmd.exe	32
PID 2916 wrote to memory of 2884	2916	cmd.exe	32
PID 2916 wrote to memory of 2884	2916	cmd.exe	32
PID 2916 wrote to memory of 2884	2916	cmd.exe	32
PID 2884 wrote to memory of 2744	2884	msinn.exe	33
PID 2884 wrote to memory of 2744	2884	msinn.exe	33
PID 2884 wrote to memory of 2744	2884	msinn.exe	33
PID 2884 wrote to memory of 2744	2884	msinn.exe	33

C:\Users\Admin\AppData\Local\Temp\b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b122a3a8578ecdf75a6343441e1e804d_JaffaCakes118.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\28sagl15.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\msinn.exe
    C:\Windows\system32\msinn.exe
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Indicator Removal: Clear Persistence
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\28sagl15.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Indicator Removal

1

T1070

Clear Persistence

1

T1070.009

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\28sagl15.bat

Filesize
125B

MD5
5d92bcd578fa29f8bcd30fadfb593336

SHA1
b4d0915221fd51b94f4def70deeb536fe7eb3443

SHA256
49305dc9688744753552fb8aace4b2c6937800f16aff1315cd16d43f95654653

SHA512
7e053d8c0908eaadebdb8c65dca10a03299e58ebf53f4a4a66be228bdf5fe3b2588d6f5263d47338fbffa93b13fc071af0bed22af486744077efc58debe8be50

Download Submit
C:\Users\Admin\AppData\Local\Temp\28sagl15.bat

Filesize
235B

MD5
fe795b84c3858861962157defb3d2906

SHA1
73753809018b1e7c34d04dfedb8f8ed7437ff9aa

SHA256
1a98594d9307db72bdf02280ebdb8d8d6e075c8b8f5642c424ba3ced6f218692

SHA512
5f8c776b78ba643e4b5cdbc4baa4756b387959f0485ce6d9f08a911618afd7d4a0e27b3b6fc1c063364d20b310ce504bc0dfafa07abf8778cc0b19e53ea1adc5

Download Submit
C:\Windows\SysWOW64\msinn.exe

Filesize
39KB

MD5
b122a3a8578ecdf75a6343441e1e804d

SHA1
761e0c91c9bcfff977f0bc61b78d1a0278134868

SHA256
89fa499b45546a9a9e71a5cafc9c743decc52dab52139ed0c08182a9f450cbbb

SHA512
72a7c2e781359979051ea41ae5e3980c425e856e627c91a2cf59f7b99f1c91d2bb6ade0214a66238344d5a6e9718a093cadf6e69dea67a86506394eb661ad9bb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads