eef2a675e406239e8333c7099cfc0e0c670e69c4662487b32e6bbdb34aebcceb

General

Target

c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Size

3KB
MD5

c0bdadc0f9eac664d1921611ef75c5d9
SHA1

81711756953f5bc080a006c85e022324d5da3eeb
SHA256

eef2a675e406239e8333c7099cfc0e0c670e69c4662487b32e6bbdb34aebcceb
SHA512

070fdb8173fbae95cf4234d7bb0fdf01dc268c2f97bd7a59f869b79e2f1c455d1d61dd1074e1e2ad5eff8f61e0cde9e0d2d633ce042c001d0b489ea9bc774d47

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-25-c4-f9-08-32\WpadDecisionTime = 208b5eede9f6da01	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-25-c4-f9-08-32\WpadDecision = "0"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB2C9543-E846-4065-AD6A-979236373B63}	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0074000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB2C9543-E846-4065-AD6A-979236373B63}\WpadDecisionReason = "1"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB2C9543-E846-4065-AD6A-979236373B63}\WpadDecisionTime = 208b5eede9f6da01	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-25-c4-f9-08-32	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB2C9543-E846-4065-AD6A-979236373B63}\22-25-c4-f9-08-32	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB2C9543-E846-4065-AD6A-979236373B63}\WpadDecision = "0"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB2C9543-E846-4065-AD6A-979236373B63}\WpadNetworkName = "Network 3"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-25-c4-f9-08-32\WpadDecisionReason = "1"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2808

C:\Users\Admin\AppData\Local\Temp\c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\c0bdadc0f9eac664d1921611ef75c5d9_JaffaCakes118.exe -A
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing