058a589ca4487966b442d4f4f8c9209164bfdd79cf41c32f204312fcc730e143

General

Target

dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
Size

341KB
MD5

dcaeaa8142662e8bbf296baef7236f2d
SHA1

d326084e64b81ee2f307d3f327b3e7c824af01c4
SHA256

058a589ca4487966b442d4f4f8c9209164bfdd79cf41c32f204312fcc730e143
SHA512

53c4b0312171e822c018cd75209ffe75110421033f57bd36fa4d442f80ea4f97033b16b7a6aba8e6e864e1341c6b57cc17dba86ef0f383b17fdc271cd0356385
SSDEEP

6144:1TBhHPXmcZ/Lbii5bkgVuN+xSKV7Wkrsf7LsA0RrRNPdikynEY:19hvXmcdXikbkgaISKVg0RrRNP4jnEY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1168	DE684BAD-3994-42F8-9ABD-9043E85430DC.exe

Loads dropped DLL 6 IoCs

pid	Process
2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE684BAD-3994-42F8-9ABD-9043E85430DC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1168	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	32
PID 2500 wrote to memory of 1168	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	32
PID 2500 wrote to memory of 1168	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	32
PID 2500 wrote to memory of 1168	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2916	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	34
PID 2500 wrote to memory of 2916	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	34
PID 2500 wrote to memory of 2916	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	34
PID 2500 wrote to memory of 2916	2500	dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcaeaa8142662e8bbf296baef7236f2d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\DE684BAD-3994-42F8-9ABD-9043E85430DC.exe
  "C:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\DE684BAD-3994-42F8-9ABD-9043E85430DC.exe" -y -p993CD357-0F1B-437E-BF56-8C82886DF750
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1168
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" c:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\start.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\DE684BAD-3994-42F8-9ABD-9043E85430DC.exe

Filesize
208KB

MD5
5abb084a0e7a9c60512fa6f5c4883ad6

SHA1
c6144a514d5acd7e0c269603f3a13e9aa5fc5e67

SHA256
2e0c4736cb7b5ae065e9561da910c863700f551c648edd84901d4c48460819a2

SHA512
5f983f996e94ceaf86d38469d7e83b1ddd1f3c324134d59299a2c7031ee77bf714d0be10ff84349ced7bca4e323c244820891f018ef217347634f80ca2bf1f4b

Download Submit
\??\c:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\InstallerHelper.dll

Filesize
132KB

MD5
22e11b4a53b6c4b4f221590fee50d48c

SHA1
215687d8eb983b3f05101ff6c07cb500f275bf23

SHA256
1ae1008eebb331d12ced01b923bbd90eb6d1098e015f949be949883dc1c52fd0

SHA512
3f8511d998baccb2dad319940b8085fc81c65a9f6f8490165617b8f0ad2ee4bed0c14d8f580902117364be5c53f5a15004c5b46d1466192de88acb720b60f644

Download Submit
\??\c:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
\??\c:\a0f39d34-52d4-4ec7-be64-c8bb9b7c871c\start.hta

Filesize
1KB

MD5
db4ada697fa7a0e215281533d52578e9

SHA1
fb755ea8371edf5065dc53e21eb413603f9eba7f

SHA256
f949fd6ca734830572128b4348dfd039419140c7ef501d80773f71ca3f0ed78c

SHA512
9ba1d2658785dd3c88b4399132f8330dc58872235e19ca9854b0e453d8cc7a58de0c8be84da376a72b5851073f531c95b2c6afa84f43053561ca8e6751d6e2f3

Download Submit

Analysis

Sharing