9c595737b3de0df56574d6aa102e5f8cd92cdc8f5cbd748abab285a2267a25de

General

Target

ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Size

36KB
MD5

ba83148da9e019f23e3dd564491cee71
SHA1

4b3ec807e2c610c3c4737157c1cf7c02c1f4b28c
SHA256

9c595737b3de0df56574d6aa102e5f8cd92cdc8f5cbd748abab285a2267a25de
SHA512

1b0f761ea846dde2dfa2d3ebd41673ea251122785c4cc4de38212dc7b33282a522cc5a779853078cf78e0b98f380ab1f7cd7b2bbd744f9943435e1c2f11d52fa
SSDEEP

384:9xxyXIZZSO9W4ui0Ch2FBvvikkth9Tjbacva8px0HxCfJCpLHGfJCpL3:9eXIe14uwh2TvvQhRjbacva8tfGGf2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
2636	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Client = "C:\\Windows\\system32\\wuclient.exe"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XPSP2 Firewall = "C:\\Windows\\system32\\xpsp2fw.exe"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\favico.dat	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wuclient.exe	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wuclient.exe	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ckAraludit.dll	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ressmgren.dll	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsp2fw.exe	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpsp2fw.exe	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\acddreld.dll	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pdsosSeppmg.dll	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchUrl	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\SearchUrl	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Search	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://realsearch.cc/?b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

Modifies data under HKEY_USERS 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Main	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Search\SearchAssistant = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Main	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Search	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Search	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Search Page = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchUrl	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchUrl	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://realsearch.cc/?a=2&b=xyz"	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Search	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d0af14a9-15e2-5342-c52b-8578a56d0af1}	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d0af14a9-15e2-5342-c52b-8578a56d0af1}\ = 9500000000000000100000001ea1f0d2100000001ea1f0d2510000001e000000100000007072757563747d75000100000010000000727a5063707d6475786500b5000000100000006175627e62427461617c76006000000010000000637462627c7663747f00	ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba83148da9e019f23e3dd564491cee71_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\acddreld.dll

Filesize
1KB

MD5
b4be0374e3765ed179238fc33392c1d4

SHA1
fae17ee8a9ef768299d33f334d8e6a49ca6d350e

SHA256
cb702709318aa3ecaa574d8ecee7067098f74317dde40e4d057cb50cbeea8442

SHA512
9258731d2c656dc64f2ea4bd8e32662c212e577927f735eef5a718b02546c2cbf1215964b0e4e33cb1b6f218021be11dcb22b7c7c46691e6c24faf019822e53d

Download Submit
C:\Windows\SysWOW64\ckAraludit.dll

Filesize
9KB

MD5
1641cf2bce0ad11f826c42646fa60a92

SHA1
557bc9148ce2ea29e0d2f28d55003ff84fada10d

SHA256
df60ee913a28e9154b4deaddafcd70c4580f0a946dceb28995ed73bdcfcd29f0

SHA512
723dec4e1dba2ff8f474247fe270d018145e229e5d7f201d517a0ef6ec8f397fc4d2196e116b5ac7ef9166fc07af1c012f9b079805d9738132780fca044eff7c

Download Submit
C:\Windows\SysWOW64\pdsosSeppmg.dll

Filesize
2KB

MD5
b7e6e91e7a8efbc7a2014ceb6961da1d

SHA1
451fc2c2d7aed9efbdaa7d2ce3839a1488eb17cb

SHA256
dd90a0ca50ab0c7668f5184166d7848b1d773ae2b862382f18c85d3c18cb02c9

SHA512
c0de05b5c4be627b1bbd334c40de3c336b6a3265eecb428a8fdcc4d9ccb7b0e2ffc5cdaf6a02859b8f20dbe6feaa3acf176418b2ae13831706507a38532d9261

Download Submit
C:\Windows\SysWOW64\ressmgren.dll

Filesize
2KB

MD5
831c549c3903dce08aff4225a0731b5d

SHA1
3c94df395a2b0cfdf7922c54e978620c7f7e4574

SHA256
a8217ea2fc079a115a28a6c365bfaabd7ce261d5d3454d853f9592c7a53706a0

SHA512
b287b618e93396f2e424c9f67764e7180150bbb5c8cd0ebff6f56a1737e6ecf70bb754a36f9f3715e6f5a7dc0ae85453b10c01b75b10700368a023357068c7a6

Download Submit
memory/2636-26-0x0000000000B00000-0x0000000000B04000-memory.dmp

Filesize
16KB

Download
memory/2636-18-0x0000000000B00000-0x0000000000B04000-memory.dmp

Filesize
16KB

Download
memory/2636-19-0x0000000000B01000-0x0000000000B02000-memory.dmp

Filesize
4KB

Download
memory/2636-25-0x0000000000B50000-0x0000000000B53000-memory.dmp

Filesize
12KB

Download
memory/2636-11-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2636-33-0x0000000000B10000-0x0000000000B13000-memory.dmp

Filesize
12KB

Download
memory/2636-38-0x0000000000B00000-0x0000000000B04000-memory.dmp

Filesize
16KB

Download
memory/2636-37-0x0000000000B10000-0x0000000000B13000-memory.dmp

Filesize
12KB

Download
memory/2636-48-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2636-49-0x0000000000B50000-0x0000000000B53000-memory.dmp

Filesize
12KB

Download
memory/2636-50-0x0000000000B10000-0x0000000000B13000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads