0621b6cfa743c44d46fe11872b0465bfba8c8cfeb561c33df8c79e32bc3482e7

General

Target

c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe
Size

84KB
MD5

c8e892ea864aea844c8282de285e8128
SHA1

ac01d9042d5b5b63710c5f015f4ff842e492e6ed
SHA256

0621b6cfa743c44d46fe11872b0465bfba8c8cfeb561c33df8c79e32bc3482e7
SHA512

58f394edaa7344c7f8226a8b15c9c8bda6efffe56c3d16e20be7b407566a3ec0c3064e5443ce737a1de6168377ebd415a8ab8b58acbba56e0069997846556f26
SSDEEP

768:r1dnlj1Jdm592tksv0un0z+7Fbn/A/n7sdSm9gPrdVlkUYIHXPm0cTsVVUpEp:Z4r2Wsv0u0zSY/A0m9fUB3Pm0AsVgEp

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\TMP_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\TMP_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.TMP\ = "TMP_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\TMP_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\TMP_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.TMP	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\TMP_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\TMP_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
236	c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe
2672	AcroRd32.exe
2672	AcroRd32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 2752	236	c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe	30
PID 236 wrote to memory of 2752	236	c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe	30
PID 236 wrote to memory of 2752	236	c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe	30
PID 236 wrote to memory of 2752	236	c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe	30
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2752 wrote to memory of 2576	2752	cmd.exe	32
PID 2576 wrote to memory of 2672	2576	rundll32.exe	33
PID 2576 wrote to memory of 2672	2576	rundll32.exe	33
PID 2576 wrote to memory of 2672	2576	rundll32.exe	33
PID 2576 wrote to memory of 2672	2576	rundll32.exe	33

C:\Users\Admin\AppData\Local\Temp\c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8e892ea864aea844c8282de285e8128_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TMP9660.TMP
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TMP9660.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.bat

Filesize
173B

MD5
56c03b65d5a97bbc114772172de36849

SHA1
84f3598b8d20518dca847b0d2d324131c9b77749

SHA256
078dce039e69e9b9418db6e23279445a4e7f7754044fa998e6b20cf549f92b92

SHA512
07f9e8df4a677132984507bbf4cca5c202dbd56385e4979d4c7cbf95065e245e2435e93409f0ef2d34e9906b6f05966b662ff2469282eb3c83ae88320c30e1ad

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3c9c972b8c364a87222ddd59bb704a2

SHA1
07c3c569afed8fa1ce206f74b3d5838079ec1fc7

SHA256
09d22bc9a7e00b029bec6b72cf3e399b50edefd1fcccb178bb74ad7df6562cff

SHA512
c07c3490e214b9c82c8ea02a285a5694c79ffd65d191b7ac7cfe8d911905a2d77fa6ef1203e8bb1bfe0b4687e13b7afd9e09bcb14bc11dfcd17b1447587c35af

Download Submit

Analysis

Sharing