5a843297d3f2cec4f188d0f594259ae948ed4cad773aa20eef795e372ce6b46b

General

Target

d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
Size

477KB
MD5

d443a3d432fe844df192481b784a1c7f
SHA1

fa1b9bf35e4af392e1c543e12ffe5c2ee1093d91
SHA256

5a843297d3f2cec4f188d0f594259ae948ed4cad773aa20eef795e372ce6b46b
SHA512

e347aabefc0a919b84bca4627c68d71e09ddf9da6e18cae3d1e4d3ffe3ae931cadd9ed89934393f9d24024a27d0761048895576d57101e1caae4a4d7f3f4b50d
SSDEEP

12288:orFDUdW3a/gvWlqr5l/ecETSU9C+T/yE1:MFIdWfvWOiW+T/y

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1652	rundll32.exe
1652	rundll32.exe
1652	rundll32.exe
1652	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\VMware Authorization net Services = "rundll32.exe mmorggplay.dll,ServiceMainManual"	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mmorggplay.dat	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mmorggplay.dat	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mmorggplay.exe	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mmorggplay.exe	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mmorggplay.dll	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30
PID 2424 wrote to memory of 1652	2424	d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d443a3d432fe844df192481b784a1c7f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe mmorggplay.dll,ServiceMainManual
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mmorggplay.dat

Filesize
234B

MD5
d99c08c93a047b67b90a3279c463d5ec

SHA1
49f9bedea2ec2b21147c13f689ae540c99cede19

SHA256
3dd22a19b5bed66cec8b26776c1e59b15978a5ecc3cd59da37f120e0ca0e2d0d

SHA512
5126663c6c1306a2e5bb4d6e9e275b98afbbc2f6eefcaf732348d6607abafb3dd6a92735264b4e10116925f1b7d20afa4d5acf87b23864aa9ade55a023f7a1c2

Download Submit
\Windows\SysWOW64\mmorggplay.dll

Filesize
331KB

MD5
fbde1fe1aa53ae49aa789e1903514f3e

SHA1
ae00859fe9c731620a7346faa8d34862774e1765

SHA256
5fdf176b584c0b1cf0393d30e9e95dc86e2e256285670c42433473c1599b64ce

SHA512
c9921da6077c954ad5b000c272452824ad7cd6f7faaafd58a4329902856dd4a9a835fa36b09cb8f2c7ab7cc9b78cd22b80e791fe016d40931a1b7eb4e1be96e2

Download Submit
memory/1652-8-0x0000000000250000-0x00000000002A9000-memory.dmp

Filesize
356KB

Download
memory/1652-11-0x0000000000250000-0x00000000002A9000-memory.dmp

Filesize
356KB

Download
memory/2424-10-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads