94a63d93b9266b23a006a80b05b65eee885aecba53d2eda48f920580209dbfa0

General

Target

b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
Size

237KB
MD5

b557f0af03b1e60938923ad40a26d8e0
SHA1

80f19548f4ce34ee2b62fadf360f244d998ac568
SHA256

94a63d93b9266b23a006a80b05b65eee885aecba53d2eda48f920580209dbfa0
SHA512

c7009bdfd7ad6c5b94ad61fa0e0ce1f8bfde9eb23c3487fee750b31a7f409e020dcb819fa3c6eb59dcb41aa38d0f6eb30d1381687ceee929cc34ca13450fe438
SSDEEP

3072:QNBg56EuMelmameAJBZQJfQWzQQcvPoVrRwDHn:QNhMUmVmJfFQQcnoVy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
400	RASPPPOE.EXE

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{469664e3-aa80-4942-9fc0-a6115c22395e}\SETA1CE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{469664e3-aa80-4942-9fc0-a6115c22395e}\SETA1CE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{469664e3-aa80-4942-9fc0-a6115c22395e}\NETPPPOE.INF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{469664e3-aa80-4942-9fc0-a6115c22395e}	DrvInst.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	RASPPPOE.EXE
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RASPPPOE.EXE

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAuditPrivilege	3128	svchost.exe
Token: SeSecurityPrivilege	3128	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 400	4940	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	85
PID 4940 wrote to memory of 400	4940	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	85
PID 4940 wrote to memory of 400	4940	b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe	85
PID 3128 wrote to memory of 1516	3128	svchost.exe	99
PID 3128 wrote to memory of 1516	3128	svchost.exe	99

C:\Users\Admin\AppData\Local\Temp\b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b557f0af03b1e60938923ad40a26d8e0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\RSPE8482.TMP\RASPPPOE.EXE
  RASPPPOE.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c6f48062-fafc-484e-a677-5e2955d7b3a6}\NETPPPOE.INF" "9" "4f9efc093" "000000000000014C" "WinSta0\Default" "0000000000000144" "208" "C:\Users\Admin\AppData\Local\Temp\RSPE8482.TMP"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RSPE8482.TMP\NETPPPOE.INF

Filesize
3KB

MD5
78f90c645797a474c9fb6190f6e5c647

SHA1
a80b794d6f78c8372f9f6ace9196887934e3e7f6

SHA256
6711474ee2869d6fb10a2892fa4608e55a663a41b9f1c0c3f3433d41f79e95da

SHA512
35233a4c4ea3f9cbe964d7700210ea9a27190fdb389c0031537ca26e527193c760e60a47b162a989ffbab164b1bd5ef181184fa05c5700877ae466ff2b2f3598

Download Submit
C:\Users\Admin\AppData\Local\Temp\RSPE8482.TMP\RASPPPOE.EXE

Filesize
33KB

MD5
a145e58da9a4914d9dfd1a5ae016fa7c

SHA1
5506e947ae9501fc4275464192b990ba1869dcf3

SHA256
425a282a70b761505162353bd65b4b21da3fbe7dcf1954b37fee8e832aa2bac0

SHA512
3a2f8c8a6150eb5799f0a126f47732baf411790e7366f752606abc4e9afcd2e06b66ede57db66a089e074fa6d9f988b7435f336e09c65a974155c6b264bf6cbf

Download Submit

Analysis

Sharing