89c4dbf302dfcfbca4122c06453955eef2252743f1c1da1f365abf40f3988b10

General

Target

c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe
Size

24KB
MD5

c94c6ea3037c74280000c1bfc49b693a
SHA1

1ec78a515f98d4f0091de9eb7857f2e67e087b85
SHA256

89c4dbf302dfcfbca4122c06453955eef2252743f1c1da1f365abf40f3988b10
SHA512

d110d0a192fbafdffbc0c524f9678580cb59e3991c7e0b86d273539c745f3e32ba6ae45813e8c72df4553b74f64b3f5cad02c2edb316ccd00e5dc7c0f9c8b065
SSDEEP

192:jdW8NusyfAA0RAG0s5paBzpKyon+B+TXQlWKJdFOr5uWEM:I8J+gABghn+SXWJdFOsWEM

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2740	reg.exe
2760	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2140	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	29
PID 2524 wrote to memory of 2140	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	29
PID 2524 wrote to memory of 2140	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	29
PID 2524 wrote to memory of 2140	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	29
PID 2524 wrote to memory of 1792	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	30
PID 2524 wrote to memory of 1792	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	30
PID 2524 wrote to memory of 1792	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	30
PID 2524 wrote to memory of 1792	2524	c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe	30
PID 2140 wrote to memory of 2760	2140	cmd.exe	34
PID 2140 wrote to memory of 2760	2140	cmd.exe	34
PID 2140 wrote to memory of 2760	2140	cmd.exe	34
PID 2140 wrote to memory of 2760	2140	cmd.exe	34
PID 1792 wrote to memory of 2740	1792	cmd.exe	33
PID 1792 wrote to memory of 2740	1792	cmd.exe	33
PID 1792 wrote to memory of 2740	1792	cmd.exe	33
PID 1792 wrote to memory of 2740	1792	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c94c6ea3037c74280000c1bfc49b693a_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2740