ec09dcebf30d5a81471f7fc11ae3d73bfa3274a2a54a0652af2b8f4bbd644ed3

General

Target

b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe
Size

61KB
MD5

b2169ebc7cc119b5f14eb8b160b935aa
SHA1

384b564ea5abb4fa61a994dbd7fe11741b028c5a
SHA256

ec09dcebf30d5a81471f7fc11ae3d73bfa3274a2a54a0652af2b8f4bbd644ed3
SHA512

b3b0afc59b13bad3779157cc7f5e85b560a643c0072e89a952eaa0e3bc10efbb6e7deffbabf5f8c6abcb89fc194b58c276cb266192d48c7cbf0d86db5437fb2c
SSDEEP

1536:0syqFg9iyJK8GcVYBOHyzSskaP3TvswppJuZ:0J9pVaotuzsuLuZ

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\update.reg	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\update.reg	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	regedit.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.bcyk.net/?100147"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.bcyk.net/?100147"	regedit.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\ = "Internet Explorer"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\D\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\Open\Command	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\ShellFolder\Attributes = "10"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\D	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\D\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\Open\Command\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe http://www.bcyk.net/?100147"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\属性\ = "属性"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\ShellFolder	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\ShellFolder\	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\D\ = "删除(&D)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\Open\ = "我的首页"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\Open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\属性	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\属性\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86AEFBE8-763F-0647-899C-A93278894599}\Shell\属性\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3060	regedit.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe
Token: SeDebugPrivilege	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3060	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 3060	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 3060	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 3060	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2756	1688	b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s C:\Windows\system32\update.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Runs .reg file with regedit
  PID:3060
- C:\Windows\SysWOW64\mspaint.exe
  C:\Users\Admin\AppData\Local\Temp\b2169ebc7cc119b5f14eb8b160b935aa_JaffaCakes118.exe
  2⤵
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\update.reg

Filesize
6KB

MD5
feea26cecdab79470a499d87975d55eb

SHA1
daa7a2d670244c5644f7e92342caefa6b57d73f0

SHA256
90e9058ab389c3cb63e84bed9249abbda8398ccd081e38303cb0ea4bab8e95f1

SHA512
3de44f863abda4337fe2a862459648999805ae8ed418bc3da7fb394160e81aecfd606897de2499c5068b4a1a7ef9bb5721af0cf2183ef8a18610c55c5463d07a

Download Submit
memory/1688-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1688-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2756-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2756-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2756-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads