f6b7c4433a2e842a9d6508fde9dece4398bedd0bec7467f238eeada45f41ef18

General

Target

dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe
Size

590KB
MD5

dda97a6055f90086769220b9f46b8869
SHA1

ca6e680f87842ea69959067c4c5d5bac6b61e012
SHA256

f6b7c4433a2e842a9d6508fde9dece4398bedd0bec7467f238eeada45f41ef18
SHA512

a839b79799989a40921f52b2e8a7d270278adbfe80502cf06c313f2a1cc235517bfc1ecbf5c21c1eb8c997d6c7c954eabc990f62e9595a60d20e03827956ca94
SSDEEP

12288:GWNEGhjvdFOG6v5gROeWD1eqj0eCT6GsaUGnN3w8ebGN2V8huo/wWa9Kgewlpo:GMFjv76v5deWHjfChLU4g8ebGNw8u2Hr

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2544	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1040	winlogon.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	winlogon.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\windows\winlogon.exe	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe
File opened for modification	C:\Windows\windows\winlogon.exe	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadNetworkName = "Network 3"	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecisionReason = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecision = "0"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecisionTime = 0084854d9405db01	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecision = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\9a-ec-be-78-d7-0f	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-ec-be-78-d7-0f\WpadDecisionReason = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC565506-3216-494F-8663-11E8119F15A7}\WpadDecisionTime = 0084854d9405db01	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe
Token: SeDebugPrivilege	1040	winlogon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	winlogon.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2544	3048	dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dda97a6055f90086769220b9f46b8869_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2544

C:\Windows\windows\winlogon.exe
C:\Windows\windows\winlogon.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\uninstal.bat

Filesize
218B

MD5
86690b680aa12f138905ce51dec01e15

SHA1
add084eeac3bda4162b4ab01d6e2c77379a685e0

SHA256
df8065d5303f428c1129c09923761008a1d961fff2e7a535081d14583771a317

SHA512
245f7e04957cee7d8afd66374d3faa6e2e6c2c5c2d12fe6aa07428d7cb0e50ae49de7616e02ea637ca547cfe12ac1c9f05f79a342a1da6e8d89f96695d8c6b92

Download Submit
C:\Windows\windows\winlogon.exe

Filesize
590KB

MD5
dda97a6055f90086769220b9f46b8869

SHA1
ca6e680f87842ea69959067c4c5d5bac6b61e012

SHA256
f6b7c4433a2e842a9d6508fde9dece4398bedd0bec7467f238eeada45f41ef18

SHA512
a839b79799989a40921f52b2e8a7d270278adbfe80502cf06c313f2a1cc235517bfc1ecbf5c21c1eb8c997d6c7c954eabc990f62e9595a60d20e03827956ca94

Download Submit
memory/3048-15-0x0000000000401000-0x00000000004A3000-memory.dmp

Filesize
648KB

Download
memory/3048-6-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/3048-5-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/3048-2-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/3048-1-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/3048-0-0x0000000000401000-0x00000000004A3000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing