6360f77e91ffc89c3232fcf9edfa1807b235943107a06e386bc39b5fa42cc206

General

Target

bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe
Size

540KB
MD5

bf89df3b7763f3c0baf5007b66cac3fd
SHA1

a172e392b4ba06f066a386578e4313ad0c2e0021
SHA256

6360f77e91ffc89c3232fcf9edfa1807b235943107a06e386bc39b5fa42cc206
SHA512

de587daceb0adb7da2bb242aa1481ad07b26bf9c3c595b2bf6a61e3590a8ad5e90b3d16ad6a8a2ce4adcdc02f5a46e61d73aa739d4c046b46796166910bcb1a3
SSDEEP

6144:Yzv5oXpcFb5DRsNxIYf2GC2vaDjb2veepgFsk:mmZcZlyN/fFC2yDOve92k

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
1840	tazebama.dl_

Loads dropped DLL 1 IoCs

pid	Process
916	bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	1840	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tazebama.dl_
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	tazebama.dl_
1840	tazebama.dl_

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1840	916	bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe	85
PID 916 wrote to memory of 1840	916	bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe	85
PID 916 wrote to memory of 1840	916	bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf89df3b7763f3c0baf5007b66cac3fd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 744
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1840 -ip 1840
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\tazebama.dl_

Filesize
157KB

MD5
0198bb5c017a274f86b5a94430d805ae

SHA1
4bcd0394cacc916e5738ac3f31c929f7bcbff786

SHA256
fee5ae17c110f9c683adbb62e4b83721f96502dbf2255192fa26ef1c106a974d

SHA512
bd79486f24ab3960c0d8c6bc570332fdcf363cfeec471aa7349d68ac8771fba2ced36774870674c267a480c59069eab76cfb48e22d1bebbd4965a2cbc5e2bd63

Download Submit
C:\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
157KB

MD5
9592c5e231b4f0949a0d8afa44f2d1d7

SHA1
f0a895d70a3f3aabb5184f5207af425e4851b925

SHA256
9dcad2de377d843a9fe62bccc21e6457e0a2e3fb6aabd117a6cde5dc20b8581c

SHA512
a0b30bbfde9afa7027b94a1b9e0099fe10e3f22d80e0443278314fbf4d69cb8f498d8a1e96a22678d0df585abd52391965df6bbee91361575d49e97a9ae32ab4

Download Submit
F:\zPharaoh.exe

Filesize
157KB

MD5
15a01378d67aeaab843cf907e7985d1b

SHA1
ac2f7178373b4bf10dd32d098b03acb8dc62d4eb

SHA256
66baf77373a1726a6c0200a3e268a1614684cb5868b573fb169ed459ee4c1c66

SHA512
d8c12e499b3cfd4e57e9e184dbb241c0c5b03f046a533eb4b0454ce3e62f1d2b6659c7ee1655b841a0d67a598c4f16ea8f6d83215bb0c06e808253331c957514

Download Submit
memory/916-0-0x000000004AD00000-0x000000004AD61000-memory.dmp

Filesize
388KB

Download
memory/916-8-0x000000004AD04000-0x000000004AD0F000-memory.dmp

Filesize
44KB

Download
memory/916-40-0x000000004AD00000-0x000000004AD61000-memory.dmp

Filesize
388KB

Download
memory/1840-10-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1840-39-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads