29d16f7edc87bdf2813ad2ea4b9f2245eb3d9b0c707f6486b6b1969a8c8e991c

General

Target

d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
Size

156KB
MD5

d1de875b2da0f6bd0087b18b76ce6a20
SHA1

65474f71755e9d998d17f601d83a4984ccf51947
SHA256

29d16f7edc87bdf2813ad2ea4b9f2245eb3d9b0c707f6486b6b1969a8c8e991c
SHA512

e887ce19e09c1b335964f20b85aab1817a8dc14253e8e5402d6cfebe0432230446f609043ba05f394896ee13040ca65897145f042d8ee6aa2a70f23d02293631
SSDEEP

3072:qlyeIeQpQ1FVLO9VWIIT5a19rjOxiCsJiEnx1TlMYmvNOfug8EW9SZp8X/sEW9al:GQjiip4IlMYm1Ofun9SZp+kEvzNFG6aI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2916	acrotray.exe
1324	acrotray.exe
1076	acrotray .exe
2888	acrotray .exe

Loads dropped DLL 4 IoCs

pid	Process
2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
2916	acrotray.exe
2916	acrotray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\adobe\\acrotray.exe"	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray.exe	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcssync.exe	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
File created	\??\c:\program files (x86)\adobe\acrotray .exe	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acrotray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acrotray .exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431871875"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C94D2561-6D0F-11EF-B686-FA59FB4FA467} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
2916	acrotray.exe
2916	acrotray.exe
2916	acrotray.exe
1324	acrotray.exe
1324	acrotray.exe
1076	acrotray .exe
1076	acrotray .exe
1076	acrotray .exe
2888	acrotray .exe
2888	acrotray .exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
1324	acrotray.exe
2888	acrotray .exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
1324	acrotray.exe
2888	acrotray .exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
1324	acrotray.exe
2888	acrotray .exe
2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
Token: SeDebugPrivilege	2380	d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
Token: SeDebugPrivilege	2916	acrotray.exe
Token: SeDebugPrivilege	1324	acrotray.exe
Token: SeDebugPrivilege	1076	acrotray .exe
Token: SeDebugPrivilege	2888	acrotray .exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
836	IEXPLORE.EXE
836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2380	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2380	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2380	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2380	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2916	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2916	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2916	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	31
PID 2644 wrote to memory of 2916	2644	d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe	31
PID 2916 wrote to memory of 1324	2916	acrotray.exe	33
PID 2916 wrote to memory of 1324	2916	acrotray.exe	33
PID 2916 wrote to memory of 1324	2916	acrotray.exe	33
PID 2916 wrote to memory of 1324	2916	acrotray.exe	33
PID 2916 wrote to memory of 1076	2916	acrotray.exe	34
PID 2916 wrote to memory of 1076	2916	acrotray.exe	34
PID 2916 wrote to memory of 1076	2916	acrotray.exe	34
PID 2916 wrote to memory of 1076	2916	acrotray.exe	34
PID 2396 wrote to memory of 836	2396	iexplore.exe	35
PID 2396 wrote to memory of 836	2396	iexplore.exe	35
PID 2396 wrote to memory of 836	2396	iexplore.exe	35
PID 2396 wrote to memory of 836	2396	iexplore.exe	35
PID 1076 wrote to memory of 2888	1076	acrotray .exe	36
PID 1076 wrote to memory of 2888	1076	acrotray .exe	36
PID 1076 wrote to memory of 2888	1076	acrotray .exe	36
PID 1076 wrote to memory of 2888	1076	acrotray .exe	36

C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_jaffacakes118.exe" C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\program files (x86)\adobe\acrotray.exe
  "C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\program files (x86)\adobe\acrotray.exe
    "C:\program files (x86)\adobe\acrotray.exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- - C:\program files (x86)\adobe\acrotray .exe
    "C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\program files (x86)\adobe\acrotray .exe
      "C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\d1de875b2da0f6bd0087b18b76ce6a20_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\acrotray .exe

Filesize
193KB

MD5
259c01965a573ec603c9eda0def20d20

SHA1
fceb93d025d1295e13743e6d6dce4519d97f6684

SHA256
5e94a5f9d2a341e6d00ea5a5a6f781bde13c6f6b129711dcb0756674bba2bb59

SHA512
1a3230cc9b38f2ac1c0ae9bfd996d78cc72e430a9c49dcdbee7899fa72e16dcb1a5e9975a03b4df059fc712083eba7ec9a1aefc47277f196108b4aa8f96a3be4

Download Submit
C:\Program Files (x86)\Adobe\acrotray.exe

Filesize
183KB

MD5
14f48aaeecd4a21f383ef76d5b002738

SHA1
95e353029a67616f1a2ff97af7d2d1e6a2642164

SHA256
5a0e8ac3ef41fbd55c91c5825b7cfa3042c6c81f584562722338ae7f4067f0c2

SHA512
9f709e232e97d33cef9bd03a1ccc174f92d9238e3a36fea3e94f611791b3a88dd0984f666c35b2e1ef88334e25be5cc21e7469dc17c1e791ee704e8e556f6356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1694f48c3ad35b286283891fcbd3f587

SHA1
8477c4398ad96786cbe8b734c6f0f60d3454698a

SHA256
3dcce795d2ab95a6ea12c7e27dbea81cd83b596b6d991b04a296d971deb9ca73

SHA512
9bf99355f71608d293ac3fb2a5214ebc98937611c8b514371dd06fe1f27cf7e684e72d293d32e3ecbbdc3b8fd33530c3c32bdc5929487a878215de8329d43b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82364dc1c5027dacf8a3b0ec1de6f59a

SHA1
bb597142587a88744c61322a1ea3a3879b835085

SHA256
ed21809f1dd05944af538c55fe6a044d38017413b588725987f3e742bb15ae96

SHA512
949f1f36e503d4f0bdf29403f6faaae6fe5710a813ddc80dba3cea7e781c7edec0bd1952448b803e59eb290801e9ac28baebe28f7bbe47da4ee9d6b7cb86a502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fad6100680f3ef9ba234e2f5fc98e168

SHA1
4f25fd6ac831cf89947ab69448e391ff6138d940

SHA256
e73f31828e5d25209a56fcb8d312186235979ee8eeb987ed399835e302100c49

SHA512
c418afb2ca2ac9982f88993d5926751c0b36eb1f000323997fe40f527eb0727d7830e7b1023c92a5ca7133bbaf8b690cf6089968cc24ee27cbf3232152f2d03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cc2cc0ed51106f8d15705613997d91a

SHA1
810ec59d5df6481045a8bcd361c01abef7ebd3f9

SHA256
c0f7ecd03fb1f25403a96e5bcec77ac18ada9d56a8d9574503c149f95ae17b2d

SHA512
96f6e59a2a9ac1048a1ebf6e50e85fc40c3192f1177a62aa970b813ee4cea5fddc1090805b8556df68f00c28d590d9cb8f01deed77853ed2066d5a26959706d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AE2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1076-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2380-31-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2380-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2644-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2644-30-0x0000000002B00000-0x0000000002B1B000-memory.dmp

Filesize
108KB

Download
memory/2644-49-0x00000000021C0000-0x00000000021C2000-memory.dmp

Filesize
8KB

Download
memory/2644-22-0x0000000002D90000-0x0000000002DAB000-memory.dmp

Filesize
108KB

Download
memory/2644-21-0x0000000002D90000-0x0000000002DAB000-memory.dmp

Filesize
108KB

Download
memory/2644-24-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2644-4-0x0000000002B00000-0x0000000002B1B000-memory.dmp

Filesize
108KB

Download
memory/2644-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2644-483-0x0000000002D90000-0x0000000002DAB000-memory.dmp

Filesize
108KB

Download
memory/2888-45-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2916-35-0x0000000002B50000-0x0000000002B6B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads