03fb859539df4c61c6653637ddb06b3c8d5de67dd34cf51e09d3f08fad021189

General

Target

b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe
Size

46KB
MD5

b7cf197995818ced0028405bc425f4dc
SHA1

289d2cfc84c64093ec8707f22fd3559833cda224
SHA256

03fb859539df4c61c6653637ddb06b3c8d5de67dd34cf51e09d3f08fad021189
SHA512

6651990312d22fd51401162b655f66c745bf1d9d09763ebb6c0044f597de58845b205e542f02588f987defe1974e1ead0fc866bdc1f18fd950da647a12bdaac3
SSDEEP

768:ESd3AsrIXEh8WfsztZGBYKu9G/ZyTZj1urLdHjsdwOhme/O2MFn4LXx:MIomsztd2l3lsmOhmyO1Fn49

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\IEHost2Services\Parameters\ServiceDll = "C:\\Windows\\system32\\IEHost2Services.dll"	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2412	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1756	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IEHost2Services.dll	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5E03DC4-CEA5-4B51-B25F-250C230565DB}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5E03DC4-CEA5-4B51-B25F-250C230565DB}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-98-ba-e4-28-49\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5E03DC4-CEA5-4B51-B25F-250C230565DB}\WpadDecisionTime = f0a9573797f4da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5E03DC4-CEA5-4B51-B25F-250C230565DB}\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-98-ba-e4-28-49\WpadDecisionTime = f0a9573797f4da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-98-ba-e4-28-49	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5E03DC4-CEA5-4B51-B25F-250C230565DB}\ee-98-ba-e4-28-49	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A5E03DC4-CEA5-4B51-B25F-250C230565DB}\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-98-ba-e4-28-49\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0087000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2116	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2412	2116	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2412	2116	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2412	2116	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2412	2116	b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b7cf197995818ced0028405bc425f4dc_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B7CF19~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k IEHost2Services
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\iehost2services.dll

Filesize
23KB

MD5
8e2f4fe28819c2907276b02cd2c113a7

SHA1
1d92bbd63db5fed88a17497c932e8b411708c7a8

SHA256
8b56dcdc9eaad6eb1a9a54913fd842379053c5ee560307e327ec9291edabebcc

SHA512
1842b01e93a41d06f126ff872e2de9b96ca139406f472f8b7ff7ad32e5ee9befe09ec2ceed4692f68c111be33b958c1ac5c00c41702ef4838200165eff9a7b29

Download Submit
memory/1756-14-0x0000000010006000-0x0000000010007000-memory.dmp

Filesize
4KB

Download
memory/1756-12-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1756-11-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1756-9-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1756-15-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1756-16-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2116-2-0x000000000040B000-0x000000000040C000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2116-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2116-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing