01ceb67aec25251266e8c8b9fe29ff42c60b6650e1f40ba4e51700a6441a3342

General

Target

e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe
Size

1.0MB
MD5

e07b5441c9acd9b89ab89a57b50109be
SHA1

b5c8d2f88394dcd1cae980c19ba2c57cbf6e5168
SHA256

01ceb67aec25251266e8c8b9fe29ff42c60b6650e1f40ba4e51700a6441a3342
SHA512

460833a6cd24ee06ec98873ef54977ee64df73407823dc009b685ade9c8c68d4af72176882578ed03a463f7d8de4eef851751c911fc172d3e26170b15f05ef47
SSDEEP

24576:Jxo8nGgVjDXdVy8/c7gxC2IvxOPxFQmXtKk:JmuGg1XfHUgp1P4mdKk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2052	SERVER~1.EXE
3904	WinDir

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\WinDir	SERVER~1.EXE
File opened for modification	C:\Windows\WinDir	SERVER~1.EXE
File created	C:\Windows\uninstal.bat	SERVER~1.EXE

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVER~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDir

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	SERVER~1.EXE
Token: SeDebugPrivilege	3904	WinDir

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3904	WinDir

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2052	1976	e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe	84
PID 1976 wrote to memory of 2052	1976	e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe	84
PID 1976 wrote to memory of 2052	1976	e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe	84
PID 3904 wrote to memory of 4308	3904	WinDir	90
PID 3904 wrote to memory of 4308	3904	WinDir	90
PID 2052 wrote to memory of 1056	2052	SERVER~1.EXE	95
PID 2052 wrote to memory of 1056	2052	SERVER~1.EXE	95
PID 2052 wrote to memory of 1056	2052	SERVER~1.EXE	95

C:\Users\Admin\AppData\Local\Temp\e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e07b5441c9acd9b89ab89a57b50109be_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056

C:\Windows\WinDir
C:\Windows\WinDir
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE

Filesize
670KB

MD5
0ee409446dadd252ffb2eb71e4a1ad37

SHA1
0dd767bcd5facf2f4ebed6d51f23dc7fd35dc6de

SHA256
238ace40fc672a7e84d1df2afe1c7c1dffa4bff819d50aad6d30c3d783fd4bd4

SHA512
da3a6aba7618b145c1e8d0e435d58c3015ae50e5573832ed710e5f3bce65cdd68b0ef19e4685d8057f929ee41bcd61927b515ca7dee6fe78bebbd6240804be4e

Download Submit
C:\Windows\uninstal.bat

Filesize
164B

MD5
924ea7ae6df752587469376459875c51

SHA1
ec5fa69c7e5dcaf5b57eefadc4f25a8e4ae073e1

SHA256
46c715ac82d5774479b760757498ddb0b9f75cebc116a3da81f9e438bc9bbb09

SHA512
ea7b176a411b82faf5fcd785c67180f88f9ff28f7e24c4f4b49f8e7cdc99fb60e38722b61547a4291bdd2c56b3729045c2e8d4afbecfe03612ab0dd8a7b6ae35

Download Submit
memory/1976-3-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-6-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-5-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-4-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-0-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-2-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-12-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-23-0x0000000001000000-0x000000000110B000-memory.dmp

Filesize
1.0MB

Download
memory/1976-1-0x00000000010B8000-0x00000000010B9000-memory.dmp

Filesize
4KB

Download
memory/2052-13-0x0000000000400000-0x000000000067B000-memory.dmp

Filesize
2.5MB

Download
memory/2052-21-0x0000000000400000-0x000000000067B000-memory.dmp

Filesize
2.5MB

Download
memory/3904-18-0x0000000000400000-0x000000000067B000-memory.dmp

Filesize
2.5MB

Download
memory/3904-25-0x0000000000400000-0x000000000067B000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads