993f8803d1ecd2abaaea812e87aa71cdc5405379b4f1030987443992db9c799d

General

Target

cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Size

141KB
MD5

cfe2aca5bc92bce904bd4c3cedbb2cd4
SHA1

e9de003ff68428d7cd549d0f5c8075187fdb4617
SHA256

993f8803d1ecd2abaaea812e87aa71cdc5405379b4f1030987443992db9c799d
SHA512

c16ba48d6fb17e679897235760e5562ea34a0083b98341ea475d47d657f6bfdb9db7023300d72b4af9ced3d677fe23f7c6e0bb639573bb242d93933ef5866f07
SSDEEP

3072:nXdthuiE85axzA+cYEjmRM8mFsD68unfzZJZ7ENWkKZDcRengVQfH:X/huiE0NYJB6jZhtng

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\URL = "http://www.baidu.com/baidu?tn=flstudios_cb&word={searchTerms}&cl=3&ie=utf-8"	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\SearchScopes	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "baidu"	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet explorer\Main	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\SearchScopes\baidu	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\DisplayName = "°Ù¶ÈËÑË÷"	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://hao.uenet.info"	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://hao.uenet.info"	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 800	4084	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe	86
PID 4084 wrote to memory of 800	4084	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe	86
PID 4084 wrote to memory of 800	4084	cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfe2aca5bc92bce904bd4c3cedbb2cd4_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cvdbsy.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvdbsy.bat

Filesize
212B

MD5
14f0111787c5d0a2c1369538b5601c1f

SHA1
03fef2d4a86318400c26ee2326067eb58a359973

SHA256
08121c903067f0ad4b44f4f57b3ede3d8088ebfd895ea9a48ca9c0e102e0ebb7

SHA512
78d20437d9f341c5deb26f3fbc9cd9123709ea67c7a0cb8088a41b11b4444e4c35770b6f0025bf4a486f75d7782f29e95a46d50422111e10d355b6980796ac00

Download Submit
C:\Users\Admin\Desktop\ÍøÉÏ¹ºÎï.url

Filesize
112B

MD5
1c75df5dc49c846de6eaf774bf2ba3a4

SHA1
2aa0e8169c8f51445be841589b8b4b268c8a7d86

SHA256
1b9fbb4c04d854e48ff67ecb5eede6a136519c4580d7a884db44b91a8c5b17cf

SHA512
fe5b45a8f314212fb15fe3d8c8f8567c3bcd091eafd592fa7e016635822429f8e8cb7735c420358248e852cb2395bada1af19cab820b1dedab1ceb501604852a

Download Submit
memory/4084-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads