40400c92829b508f28b155dbc8c75fe098ea3205f94cbb30cce1bdab959bba4f

General

Target

dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe
Size

379KB
MD5

dc51037a1067217eec797442059bd0c4
SHA1

d8caf1d985f074527db1acf15493d17ac8469291
SHA256

40400c92829b508f28b155dbc8c75fe098ea3205f94cbb30cce1bdab959bba4f
SHA512

3c2c025a0603c179911654dea1cb15759166fc322c6498b5ce453ea8006b9799803625668eb31bcf00d49d9822d9cda9988b5c970f85877b3811cc5653f18e02
SSDEEP

6144:AHkPmcppVIQp7en0D8EfAa/07K8aZnnbtkbIINdT6H8nVfxU+/jlYQC5t:AHkPlpWQpqn0ZfQK8ipTINdggHU+/5Y9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4712	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\svchost.exe	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT\svchost.exe	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe
Token: SeDebugPrivilege	4712	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4712	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3416	4712	svchost.exe	89
PID 4712 wrote to memory of 3416	4712	svchost.exe	89
PID 116 wrote to memory of 1232	116	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe	92
PID 116 wrote to memory of 1232	116	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe	92
PID 116 wrote to memory of 1232	116	dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc51037a1067217eec797442059bd0c4_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1232

C:\Program Files (x86)\Windows NT\svchost.exe
"C:\Program Files (x86)\Windows NT\svchost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files\Internet Explorer\IeXpLorE.EXe
  "C:\Program Files\Internet Explorer\IeXpLorE.EXe"
  2⤵
  PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\svchost.exe

Filesize
379KB

MD5
dc51037a1067217eec797442059bd0c4

SHA1
d8caf1d985f074527db1acf15493d17ac8469291

SHA256
40400c92829b508f28b155dbc8c75fe098ea3205f94cbb30cce1bdab959bba4f

SHA512
3c2c025a0603c179911654dea1cb15759166fc322c6498b5ce453ea8006b9799803625668eb31bcf00d49d9822d9cda9988b5c970f85877b3811cc5653f18e02

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
149638418cab439f0990a3e963c9c0aa

SHA1
616032e145674e6c11a7a4fcb3b51f1b8309b491

SHA256
22850f6f0cec9bc22e9ed82faeb69d53fe2dd59cfa1f20b540f4f052cac68e56

SHA512
b149139e65d82bd0cfbf542c87db95b3ca4f9b12a8065586700241eace772091ca76fd7a765c1a636054ff15e944645b2a8ebedb702a7b57244742c64089acbd

Download Submit
memory/116-14-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/116-3-0x00000000004C4000-0x00000000004C5000-memory.dmp

Filesize
4KB

Download
memory/116-4-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/116-2-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/116-0-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/116-1-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/4712-9-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/4712-10-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/4712-11-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/4712-17-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/4712-19-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download
memory/4712-25-0x0000000000400000-0x00000000004CC15D-memory.dmp

Filesize
816KB

Download

Analysis

Sharing