bd46f502707f595e6dbef85222e095e9a718b40b4ea4b8fb1b1939176bcebfa2

General

Target

afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Size

171KB
MD5

afd03cc2451544013c039c7c6839b60e
SHA1

1af9eb447a070e3aa1dec9421b95e21982e6906e
SHA256

bd46f502707f595e6dbef85222e095e9a718b40b4ea4b8fb1b1939176bcebfa2
SHA512

5128b7350744f6134cfcb98ec4c5539006511ae514bd4872c4b57d1229f857fb4f7cebd3f52099119b5baf182d9a58be89ee09022cd8eee3a4feee6dad892e6a
SSDEEP

3072:32SZu4jTJAGMeJjKJGsv4TUcNV5T5H0S6kanQXzeZGVxVp3cmcTqy163xigHI3Bw:mSZt+GT6GsWV5TFn6JQXLbIaxpHI3B9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cltmon = "C:\\Windows\\system32\\cltmon.exe"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\DllName = "C:\\Windows\\system32\\omhdt32.dll"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logon = "fnGbf2"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Shutdown = "fnGbf2"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Impersonate = "0"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Startup = "fnGbf2"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\StartShell = "fnGbf2"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logoff = "fnGbf2"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Asynchronous = "0"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\msn	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\tr4ckd	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\remdsk	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\fxddsk	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cltmon.exe	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dllcache\smdata32\odTxt.dat	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\inf0z	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\Temporary Internet Files	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\omhdt32.dll	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\omhdt32.dll	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\smdata32\odTxt.dat	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
1972	afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\afd03cc2451544013c039c7c6839b60e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gbf1.tmp

Filesize
17KB

MD5
573afac0a8420c5019d8adcfdd9c04f6

SHA1
533147404d575baa0300491cfa5ad442a3ca5548

SHA256
05c6b5febc0e815a02ba8ef348d3f28d079a3cfbc4b9e3442edf4225baad8b7c

SHA512
db3e3077ab5c8fc1d4e1fdb28088af97c1fe31bc59df6716fc91b9dfc09c2ffda7a42682150f253a0c51bb6c515a93cc9f35033989aff7343547b257047e394c

Download Submit
memory/1972-0-0x0000000000400000-0x0000000000466921-memory.dmp

Filesize
410KB

Download
memory/1972-7-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1972-6-0x0000000031200000-0x0000000031218000-memory.dmp

Filesize
96KB

Download
memory/1972-12-0x0000000000400000-0x0000000000466921-memory.dmp

Filesize
410KB

Download
memory/1972-13-0x0000000000400000-0x0000000000466921-memory.dmp

Filesize
410KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads