dd552663ded841be53ab2a2e5f55a158909558c96685163887d51008cfa5ead7

General

Target

dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
Size

34KB
MD5

dc61d58b65dbed835226b3047d9e9627
SHA1

96a4ea8b2da428338c562d740c3749215d61914c
SHA256

dd552663ded841be53ab2a2e5f55a158909558c96685163887d51008cfa5ead7
SHA512

ed0e614d875c83ecd68df26ee9b22c22d4b539bbdd3c58b733a67598d370e517754374658532862ceddfdf17485ce866898a635469fefb0d52f97b8415831464
SSDEEP

768:sPTVngLKKX7loN9l4j9i/702Z76Hns0k1OCx00nT1n:sPp8le9KgTR8nsFEK

Score

10^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\connin.exe"	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	shchost.exe

Deletes itself 1 IoCs

pid	Process
1132	shchost.exe

Executes dropped EXE 3 IoCs

pid	Process
4840	csrsse.exe
1132	shchost.exe
1792	connin.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3332-0-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3332-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3332-28-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/files/0x00070000000235fa-35.dat	upx
behavioral2/memory/1792-45-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\discard.ini	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Fsevisy.sys	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ssdtti.sys	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\shchost.exe	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\connin.exe	shchost.exe
File opened for modification	C:\Windows\SysWOW64\connin.exe	shchost.exe
File opened for modification	C:\Windows\SysWOW64\discard.ini	shchost.exe
File created	C:\Windows\SysWOW64\csrsse.exe	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	connin.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe
1792	connin.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
4840	csrsse.exe
4840	csrsse.exe
1132	shchost.exe
1792	connin.exe
1792	connin.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4840	3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe	101
PID 3332 wrote to memory of 4840	3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe	101
PID 3332 wrote to memory of 4840	3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe	101
PID 3332 wrote to memory of 1132	3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe	102
PID 3332 wrote to memory of 1132	3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe	102
PID 3332 wrote to memory of 1132	3332	dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe	102
PID 1132 wrote to memory of 1792	1132	shchost.exe	103
PID 1132 wrote to memory of 1792	1132	shchost.exe	103
PID 1132 wrote to memory of 1792	1132	shchost.exe	103

C:\Users\Admin\AppData\Local\Temp\dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc61d58b65dbed835226b3047d9e9627_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\csrsse.exe
  "C:\Windows\system32\csrsse.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4840
- C:\Windows\SysWOW64\shchost.exe
  "C:\Windows\system32\shchost.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\connin.exe
    "C:\Windows\system32\connin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4200,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\connin.exe

Filesize
34KB

MD5
dc61d58b65dbed835226b3047d9e9627

SHA1
96a4ea8b2da428338c562d740c3749215d61914c

SHA256
dd552663ded841be53ab2a2e5f55a158909558c96685163887d51008cfa5ead7

SHA512
ed0e614d875c83ecd68df26ee9b22c22d4b539bbdd3c58b733a67598d370e517754374658532862ceddfdf17485ce866898a635469fefb0d52f97b8415831464

Download Submit
C:\Windows\SysWOW64\csrsse.exe

Filesize
20KB

MD5
c02b6db53c70f38386ba2ba206176e08

SHA1
9c09f3f79da29878172421cc763730e2c817ecb3

SHA256
fcf49c9a8777dfb900e727f503841949d571b15aae4d7c6c8e0c732f92253fdd

SHA512
6851ce432b622b4e90423f60ca10c311b67a214af6029811da2b00a1867e5c0a19f0b3981495793ce66145133a1a6f858b3fa3b7cf8fd00f41a47bd01db25255

Download Submit
C:\Windows\SysWOW64\discard.ini

Filesize
105B

MD5
ea6365b4ee4d3a429d98880eaa8058a6

SHA1
a46d53dc00f6278ce869e0583c1bd28e159124f2

SHA256
ddabafa993939c464374b973ab23d2a552ae8d3a93e4012b51b69feee22ef4a7

SHA512
9a4a5d07b73751636365a27d59a6a026e8e591508a78720ed5315d4fbcb77da1faa0b70d51f09f1ea49ae8c15e1925c906b49927802289d71e12b5096911f526

Download Submit
C:\Windows\SysWOW64\discard.ini

Filesize
26B

MD5
d8ab3ea023fda33b8017ccc4748534f8

SHA1
e5c8b0f40ed03ad98f0d207ee073af2ee925db78

SHA256
14776c2d9c1446833752ec1c0686cc74bee4c3bd3036b3ad7cf51249ebe381ab

SHA512
0a6ab8641e77dcdc9b33e49462404aaf43ca549122d6fd5afc72448b5f50558859657d64d66d38415e752c05abaa225e545310986516eb1af0f691ff690ec5e0

Download Submit
C:\Windows\SysWOW64\shchost.exe

Filesize
20KB

MD5
48e4440c9c12f01eb9e6f0cd7d2e9439

SHA1
1b651537009a407ac184006db96936f6499a0645

SHA256
1692845f38558923e866cc2b33602b759ee3dc12babd7e3bf6262293b4ce47b5

SHA512
477b3dc7dee015bcd697d4a6f10996abceeb2b46300f4b33fcb733effd1ca3dc19e773b71b7a9fa335273ba5a6a9152189e78e067112be6223722e3efdcc694b

Download Submit
C:\Windows\SysWOW64\ssdtti.sys

Filesize
768B

MD5
2a34374b4d0f0e978bee7bc5e09f2b2f

SHA1
1e4f63ee905711a61b39a46db76421e00438fe97

SHA256
3e30d7259f0280f913527822e33c49f22438d10295e4f7eb8b1255f5ba38c4f3

SHA512
99df465d8f4a4a74ea0b71f15c8354c941961f6626bd3616806d75297cb4610b7b3fb3986d2024675df3419533c0ececd8fc0ff6b69a0844bbd500f380db49c5

Download Submit
memory/1792-45-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3332-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3332-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3332-28-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads