a89b1753375b1e05278bc263586f458431ba3bb699ce72300a553c59d835e85e

General

Target

c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
Size

72KB
MD5

c779357359a149be50dcbe50ba0b0aee
SHA1

4c2513eaf357236bb6002b4b309e46d45cb2bca1
SHA256

a89b1753375b1e05278bc263586f458431ba3bb699ce72300a553c59d835e85e
SHA512

d58112b6c536c144cf528e7806b902f0b33561a6092f3d15f02c7c21f4c4f8ac77bd651c54c7f653397c7c85265cb55298c455e77b089436d9663869328172e5
SSDEEP

768:R1IDznkNTPVLzuKGanJB8CGQyk0VJf45WM1h6AIM7e4VPTIjj4Vt0qK4ko:X4jUPRSranJBQ/zVZ45z/Tew/VtKo

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
2308	svchost.exe
4444	svchosts.exe
3960	svchostc.exe

Loads dropped DLL 1 IoCs

pid	Process
2308	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002350f-11.dat	upx
behavioral2/memory/4444-12-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/3960-15-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/files/0x0007000000023510-14.dat	upx
behavioral2/memory/4444-29-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/3960-31-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Online Service = "C:\\Windows\\svchost.exe"	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts.exe	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svchostc.exe	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
File created	C:\Windows\msin32.dll	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
File opened for modification	C:\Windows\sysini.ini	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
File opened for modification	C:\Windows\sysini.ini	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchostc.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://tits.hardcore4ever.net/"	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2700	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
2700	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
2308	svchost.exe
2308	svchost.exe
2308	svchost.exe
2308	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2308	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2308	2700	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe	84
PID 2700 wrote to memory of 2308	2700	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe	84
PID 2700 wrote to memory of 2308	2700	c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe	84
PID 2308 wrote to memory of 4444	2308	svchost.exe	85
PID 2308 wrote to memory of 4444	2308	svchost.exe	85
PID 2308 wrote to memory of 4444	2308	svchost.exe	85
PID 2308 wrote to memory of 3960	2308	svchost.exe	86
PID 2308 wrote to memory of 3960	2308	svchost.exe	86
PID 2308 wrote to memory of 3960	2308	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c779357359a149be50dcbe50ba0b0aee_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\svchosts.exe
    svchosts.exe -p2008
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4444
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p2010
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchostc.exe

Filesize
12KB

MD5
b74c5ca856c19bcbe7de6399d7752e8f

SHA1
4849b055528c955808c1a7e1a34d742d294d9a87

SHA256
aba46e456aed21aeb55231090a16953b73547bb4f6480e49893c8eb5f03303df

SHA512
6de484d15d092191cd6a0152c00425406a43d2ba8dcc51d1a8f8077adf4c287402f918a0d2831a0789c298904df40c044456c842ac77c9239638a71ee4da649d

Download Submit
C:\Windows\SysWOW64\svchosts.exe

Filesize
17KB

MD5
af408edfc5c6a656f93727912b9023df

SHA1
321e1e7838f8f39a2c6bf63c9f72586048228796

SHA256
215fab38da71c674f1734ee2fbe74117b996bb3faf44dc7dd27a636532737be1

SHA512
e732234631bad6d71509311203e64205702c981d0477bba26275b411afe52603cbd0631768a95199ed2ae415e2ae17e62c21c8886fbae995974a6cc4ec7f8b18

Download Submit
C:\Windows\msin32.dll

Filesize
3KB

MD5
110efc35e9ed33d47874d6fb8191fd62

SHA1
6cccd8fa729db07e7c26f2ab5f2d63ac4b92c726

SHA256
d642e5fe3852516af1427941c6cb13116b051f3be4e484b8701090930242b570

SHA512
0db71ced67905c5c0ff62c56343c7ac5c1c6b4e0729cdbf549149045b143bcc2b6534a25cb2486522366ff6d717cdc259bf875d37059c91cd093da26d9619453

Download Submit
C:\Windows\svchost.exe

Filesize
30KB

MD5
acdc7411a4fc7634ad609c15827594fe

SHA1
a08137f6fac421d588e6ac1aeff9767885826f7b

SHA256
a4ff41ca16476c61ebf6d6ca7c1b6a552a2deb10af5b69033f7dd7e597d5d187

SHA512
5c35349b6aee9d830fd3d7727c8de9f7954fb594ef632c5232a1de80cf7418865538f1bf9a022635d310a5d32b3eec8d6c7bfc112f1f1339a1eb1fb8567fcbc0

Download Submit
C:\Windows\sysini.ini

Filesize
42B

MD5
01f5641239c88d486028c4fecab2169d

SHA1
98b737ba0e731c1bc804900d34598e0a00b9faaa

SHA256
95edd82a58e7338cbfc267f71614f48ef7a2434f5f635e8d622f5de1a5a0f6f3

SHA512
7fe732228ae1dfdfc2eca0febd2bf389606f078449a872fde97996befe628216f13bcbc673592fd185360485894ed5befb9bcf8d278eb1fe399367d0e5d480b2

Download Submit
memory/3960-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3960-31-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4444-12-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4444-29-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads