05395d7107b281f1f2b42fe0ae4cdc2b1c4ec732eacc7af3d81f43233f0fc6be

General

Target

db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
Size

361KB
MD5

db8299978646b84505019eedf5bce2d9
SHA1

2f6b7317ef4e6781f7599ab73b8bb4f6064f8fad
SHA256

05395d7107b281f1f2b42fe0ae4cdc2b1c4ec732eacc7af3d81f43233f0fc6be
SHA512

902283e898e22751c6754bfbf7a17946b8bb52d7c23de36c0efa88c92852f63dff75f4b435b820c05b8dd742e4af84c7e249765c43abd5653a25a6750aba2034
SSDEEP

6144:rgU633ZwSmJy7Lbii5bkgVuN+xSKV7Wkrsf7Lss2dA+wp5lUjpW8GA8mTZWd:rgJZwSmJSXikbkgaISKVM2dUU8pA8mdm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1684	6E771AFE-39D4-4D0F-B167-2F0222A28662.exe

Loads dropped DLL 6 IoCs

pid	Process
3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1684	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1684	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1684	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1684	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	30
PID 3012 wrote to memory of 620	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	32
PID 3012 wrote to memory of 620	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	32
PID 3012 wrote to memory of 620	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	32
PID 3012 wrote to memory of 620	3012	db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db8299978646b84505019eedf5bce2d9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\6E771AFE-39D4-4D0F-B167-2F0222A28662.exe
  "C:\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\6E771AFE-39D4-4D0F-B167-2F0222A28662.exe" -y -pA1B35B39-8CA9-4680-93E6-AD4DAF20843E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1684
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" c:\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\start.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
\??\c:\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\start.hta

Filesize
1KB

MD5
db4ada697fa7a0e215281533d52578e9

SHA1
fb755ea8371edf5065dc53e21eb413603f9eba7f

SHA256
f949fd6ca734830572128b4348dfd039419140c7ef501d80773f71ca3f0ed78c

SHA512
9ba1d2658785dd3c88b4399132f8330dc58872235e19ca9854b0e453d8cc7a58de0c8be84da376a72b5851073f531c95b2c6afa84f43053561ca8e6751d6e2f3

Download Submit
\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\6E771AFE-39D4-4D0F-B167-2F0222A28662.exe

Filesize
208KB

MD5
195cee9d61fd76a49aa1edd71dd0b7f9

SHA1
48e1ab87cd6b1cfddf7209de2f132a058149b2c5

SHA256
d55160dae4bcb3900c7ee359b2f5507f013675761097897800819bb4416a71f6

SHA512
c50f8a9c8dd11853e929e678ce3066ea6e12b3a941a2dc820f929bb2e08cbe6880183fccfbc1ddab1d5200a5d43ef79323ab28dd8b95eb4d76bec91a28b5a498

Download Submit
\b83283fa-c2b3-48ef-bef8-1ff1deef02ea\InstallerHelper.dll

Filesize
132KB

MD5
1f247324cd6ee90c3549c928591d050e

SHA1
e43a203200e95a39d90d0c5cad590b1fa7cb3e81

SHA256
a4df5dc4ee0a427300f3a6c2d5794b28527fad9e0542ee310f64979e37e74805

SHA512
4a3caeb32c4be0637dcf7c8bf14ac85b2132ec705a3069fbb6c94813417b96786a4687aaa81017c301660946eae1d2debddac7cd1fa4fecac48cf6655279518c

Download Submit

Analysis

Sharing