667c2b1716fc5ec2978eda34181afe7f35dc2564b9d9d54506f0b12eb6130ac9

General

Target

b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe
Size

649KB
MD5

b1c48a02fd8fb5e97b5d028fb0e5381d
SHA1

e4dc0eeff16b3e08edfb6e9efdcb1761d77622ae
SHA256

667c2b1716fc5ec2978eda34181afe7f35dc2564b9d9d54506f0b12eb6130ac9
SHA512

3dbe02aff2b6f62ee751347891843f96abb0bd83a8d5853430894b4ac42d32c5bbfaee2fc59773a297bcb22276a3a37190597a16e5175256c1a521f489e4718e
SSDEEP

12288:ua3wloHCSUXD5cnEf5BequKDqF3Z4mxx4DqVTVOCZJb:uDMU+ERB9uKWQmXfVTz3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4996	1.exe
1036	Hacker.com.cn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	1.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.com.cn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	1.exe
Token: SeDebugPrivilege	1036	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1036	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4996	2116	b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe	84
PID 2116 wrote to memory of 4996	2116	b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe	84
PID 2116 wrote to memory of 4996	2116	b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe	84
PID 1036 wrote to memory of 1868	1036	Hacker.com.cn.exe	89
PID 1036 wrote to memory of 1868	1036	Hacker.com.cn.exe	89

C:\Users\Admin\AppData\Local\Temp\b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b1c48a02fd8fb5e97b5d028fb0e5381d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4996

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe

Filesize
271KB

MD5
7363854f89e8e80c0e735db9fb96c38e

SHA1
6baf9e9d108ff5954fbe1962a088e1e8e9134f5f

SHA256
97209518f3411a0e046ab5e064084c1750d5967ccdf1a42ec779a0744e4eca3a

SHA512
dc20f6d12246c1388e0d8e0737a5a61597d60fb06138856696f435563c22c3e23a60b974f9373eabab0f0276aebaf00441e2fc9b7ee10444d6dfca5236a2674b

Download Submit
memory/1036-18-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/1036-30-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/1036-26-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/1036-25-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1036-23-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/1036-19-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/2116-22-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-7-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-8-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-0-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-4-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-3-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-2-0x0000000001000000-0x00000000010B3000-memory.dmp

Filesize
716KB

Download
memory/2116-1-0x000000000105A000-0x000000000105B000-memory.dmp

Filesize
4KB

Download
memory/4996-14-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4996-15-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads