af88f6d760aadb2386f20cc906940eadcd7f48df3ad444cd78e1ae6aa77ef1a5

General

Target

affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe
Size

261KB
MD5

affad6a6c657608f7ac958e38bcecc02
SHA1

2d078abf6c184ad210d4a65028c81169082764aa
SHA256

af88f6d760aadb2386f20cc906940eadcd7f48df3ad444cd78e1ae6aa77ef1a5
SHA512

9e21ca5b297cbbb324a472bc9f92d6165344261faafceb2e6bec573a045a03d8f8b44019ad328dc5cb031a762417aa716fdd644ad779d652eae236b1d6f428bd
SSDEEP

3072:DkHJ32fINj+uSLiZWzANhiR3rpIdcEW6BExUm9EKUc/wdN6krLz1Xxek9Ao32niG:DPfWiFiZziR3r/EUU4EhzrLBXxzAo4p

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
persistence privilege_escalation

AppCert DLLs
T1546.009

Deletes itself 1 IoCs

pid	Process
2788	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1196	Explorer.EXE

Loads dropped DLL 7 IoCs

pid	Process
2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe
2836	rundll32.exe
2836	rundll32.exe
2836	rundll32.exe
2836	rundll32.exe
2788	cmd.exe
860	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\chardkey64.dll	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\chardkey.dll	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2836	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2836	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2836	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2836	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2788	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2788	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2788	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2788	2488	affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe	31
PID 2788 wrote to memory of 2692	2788	cmd.exe	33
PID 2788 wrote to memory of 2692	2788	cmd.exe	33
PID 2788 wrote to memory of 2692	2788	cmd.exe	33
PID 2788 wrote to memory of 2692	2788	cmd.exe	33
PID 2836 wrote to memory of 1196	2836	rundll32.exe	21
PID 2836 wrote to memory of 1196	2836	rundll32.exe	21

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2692	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:1196
- C:\Users\Admin\AppData\Local\Temp\affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\chardkey64.dll",CreateProcessNotify
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\259429101.bat" "C:\Users\Admin\AppData\Local\Temp\affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe""
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h"C:\Users\Admin\AppData\Local\Temp\affad6a6c657608f7ac958e38bcecc02_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Privilege Escalation

Event Triggered Execution

1

T1546

AppCert DLLs

1

T1546.009

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259429101.bat

Filesize
97B

MD5
d226a657b279c5fc0a892748230a56ff

SHA1
fa7e4fb6d6de3c4769001cbfce0a00ba02ef28a5

SHA256
9dae2767b8e3499d37418a75ddd04d457c7ec8d6c8f312ee109c95a8a97e7761

SHA512
07d55ccf3b511c3be64f6dcd05cea3feaafb286196e5d7ba30016ab6d9c0d656fb7cde8eb1ce0ef28a41f1f3f00f0e29020c92479619fd43e4ed47b829f8bf2a

Download Submit
C:\Windows\system32\chardkey64.dll

Filesize
99KB

MD5
f44d5f840e62eb23a834b4ebf57fc667

SHA1
a27da4c114bf61a2e16cf4f8885c51f1dd41ec43

SHA256
6edb0435b043f35c82349e167cf66636e7b0cf1c9b67c0f206b4aafdacddf5c7

SHA512
1893cdcde6a8f09bd096bd8b4208e0d539b7ab7502e8d43ca798b9917e90727e6776b27fb7093b41efec3e59b3cb56ad3da259c1f15bea5b6f504fac943e8eb1

Download Submit
\Windows\SysWOW64\chardkey.dll

Filesize
86KB

MD5
f2932eb41bd4b13293691686d78ad382

SHA1
5fd2fa49fb38acbf1545d813b91fc5193124222b

SHA256
a0e71addabec9e6dfef1bb001116b22582fc1ed74cae077b3811b02df5e16e47

SHA512
c944f29e04ee9fa7d3ee56b83627f33810da5664c9d1a51e09cf0d86244b9869ce31d35ce4d92ae66f71741ae0ac40e65dc4eb50a50f32a90ed0051efe7e39e5

Download Submit
memory/1196-33-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/1196-34-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/1196-39-0x0000000180000000-0x000000018001E000-memory.dmp

Filesize
120KB

Download
memory/2488-0-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2488-2-0x0000000001000000-0x0000000001043000-memory.dmp

Filesize
268KB

Download
memory/2488-1-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2488-28-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2488-27-0x0000000001000000-0x0000000001043000-memory.dmp

Filesize
268KB

Download
memory/2836-13-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2836-32-0x0000000180000000-0x000000018001E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads