febfb5b43a0d8319507ae58284664756f36741e6ff82052a083c39d0f1740d01

General

Target

daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe
Size

115KB
MD5

daa6da3107d7cd06c10c71b368023eae
SHA1

2b579e2c43a85410b4b1191e649520ce7b164240
SHA256

febfb5b43a0d8319507ae58284664756f36741e6ff82052a083c39d0f1740d01
SHA512

0387a7d82cbadff1189f7215533161b601c59d3290c323264690a394897d9ff55c507d66caa9924e3f1b3dac06e6ced5589719c6592a481baf76e62174a02d9d
SSDEEP

3072:muLr2tEZ8XgQzxZlPI3r9XR5769JZ78hJa1:mYeNzBq4ara1

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5100	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4348	msserv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserv = "C:\\Windows\\msserv.exe"	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\	msserv.exe
File opened for modification	C:\Program Files\AddSwitch.htm	msserv.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\	msserv.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\	msserv.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\	msserv.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\	msserv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\msserv.exe	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe
File opened for modification	C:\Windows\msserv.exe	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe
File created	C:\Windows\msserv.config	msserv.exe
File opened for modification	C:\Windows\msserv.config	msserv.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4348	4920	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe	83
PID 4920 wrote to memory of 4348	4920	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe	83
PID 4920 wrote to memory of 4348	4920	daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe	83
PID 4348 wrote to memory of 5100	4348	msserv.exe	84
PID 4348 wrote to memory of 5100	4348	msserv.exe	84
PID 4348 wrote to memory of 5100	4348	msserv.exe	84
PID 4348 wrote to memory of 2912	4348	msserv.exe	85
PID 4348 wrote to memory of 2912	4348	msserv.exe	85
PID 4348 wrote to memory of 2912	4348	msserv.exe	85
PID 4348 wrote to memory of 4900	4348	msserv.exe	86
PID 4348 wrote to memory of 4900	4348	msserv.exe	86
PID 4348 wrote to memory of 4900	4348	msserv.exe	86
PID 2912 wrote to memory of 2948	2912	w32tm.exe	90
PID 2912 wrote to memory of 2948	2912	w32tm.exe	90
PID 4900 wrote to memory of 4444	4900	w32tm.exe	91
PID 4900 wrote to memory of 4444	4900	w32tm.exe	91

C:\Users\Admin\AppData\Local\Temp\daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\daa6da3107d7cd06c10c71b368023eae_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\msserv.exe
  "C:\Windows\msserv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set allowedprogram "C:\Windows\msserv.exe" enable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\w32tm.exe
      w32tm /config /syncfromflags:manual /manualpeerlist:time.windows.com,time.nist.gov
      4⤵
      PID:2948
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /config /update
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\system32\w32tm.exe
      w32tm /config /update
      4⤵
      PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\msserv.config

Filesize
9KB

MD5
20a6c884ebfc28186ee9410b9d60852c

SHA1
87195388b985bed707cc153d1ac904a045f7998f

SHA256
27239ccf51b26f4443a66a17019229de3003b53055f9639e6096e56d48b36579

SHA512
e2b972ee24b0e0a422af394b115feda8afe03f7c0451ba5306220040f727931070294c5f0b7152061fc7adc408bf3e70e279f857108f06ff645b7ef67137090c

Download Submit
C:\Windows\msserv.config

Filesize
3KB

MD5
e6360a6334985ab7b36fd0ae039635ea

SHA1
5c4b90fd4f39a65e69f3d02aeb6fa336f4a0c01a

SHA256
1350fe714ddb2fecc5a13816a1e5944dd1b81a666e5d701f603ce1b73d2578cb

SHA512
8a79dea789116cd6175db3f3ea94c5b527e1564dc5a89e206211dac2b7825f158df5992780ad45ac73e68501a0813a2055397222359562191956618fa0e98852

Download Submit
C:\Windows\msserv.config

Filesize
47KB

MD5
195bea0a796b19d75a14f86fd6f40d2a

SHA1
f26b782426cb09b4f16bda8bab1224faae227c3f

SHA256
79609a9f89580c44ed95ec2e17dbb592cfc2cdda3ead5d2c81fc49977d055898

SHA512
663bbab1db4be2986a8d8e1da692c87c41ab63fe6c0301757f5568534e9c687fbf6ea768ee609ca4b85ac1b089da5829a0c2d8cd3e8d8cc30c4e19b914090b0b

Download Submit
C:\Windows\msserv.exe

Filesize
115KB

MD5
daa6da3107d7cd06c10c71b368023eae

SHA1
2b579e2c43a85410b4b1191e649520ce7b164240

SHA256
febfb5b43a0d8319507ae58284664756f36741e6ff82052a083c39d0f1740d01

SHA512
0387a7d82cbadff1189f7215533161b601c59d3290c323264690a394897d9ff55c507d66caa9924e3f1b3dac06e6ced5589719c6592a481baf76e62174a02d9d

Download Submit
memory/4348-999-0x0000000000770000-0x00000000007A0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads