f60a3afd41d56696492565a88d6dab19eedfb4a0ec13f153e37af4548c200acd

General

Target

ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
Size

809KB
MD5

ea7937cc603e11f852328f9de4de9a6d
SHA1

b3b3e3a122ff144853c834b2d6dcddaed90293df
SHA256

f60a3afd41d56696492565a88d6dab19eedfb4a0ec13f153e37af4548c200acd
SHA512

28337a5a767a8472e8962e17b9dbe7d6ad000cacc00fc774bcafe027256570544e898f9a2ae2924152b05f3ff6fffd5bbd6d292ff6d8d7cb9fa243e67af79722
SSDEEP

12288:+48OUL48hA1YViCkS0d5EOc27QkzU44ODFQXf7dL32cnBpoz2vyaE6qRRe3OT849:xUDv8R5EOlEkY44OO5Lmz2KeWkkIRc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2388	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Loads dropped DLL 5 IoCs

pid	Process
2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
2388	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
2388	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Norton Download Manager{N360620009-SHPD-FSD25037} = "C:\\Users\\Public\\Downloads\\Norton\\{N360620009-SHPD-FSD25037}\\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe /m"	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Norton Download Manager{N360620009-SHPD-FSD25037} = "C:\\Users\\Public\\Downloads\\Norton\\{N360620009-SHPD-FSD25037}\\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe /m"	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2388	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2388	2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2388	2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2388	2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2388	2408	ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Public\Downloads\Norton\{N360620009-SHPD-FSD25037}\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe
  C:\Users\Public\Downloads\Norton\{N360620009-SHPD-FSD25037}\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe /r
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Norton\FSDErMgt\ErrMgmt\SQCLIENT.dat

Filesize
2KB

MD5
7faa8ab0d79346c9d22f2ed1ec1365b7

SHA1
7c1c5b9e4fd907bf1b0f669f46f20b5541e9c261

SHA256
6e59dca1341855a72d14bbbda81aa10b7acb98dcdca3760e242da542eab1c449

SHA512
5c49b3fcba58626821eb5898a4c20786f270bff2164a5fa31e3b3e7be44daeb8e4f3951d2b85e9b20f74d0c071d059e84e64bebb550d0b1106d3b7a87f0039f0

Download Submit
C:\ProgramData\Norton\FSDUI-2024-09-19-03h09m45s.log

Filesize
1KB

MD5
8049df87928c5170ec209b39682054a8

SHA1
5b7b8d122eb8225c322d6875c4e0dbf922c16751

SHA256
72dcc75e47a3dcaadca5216ad5ab4a81c1ade812c2be6c65a5dfbc610f483e87

SHA512
c4876002adbe34f96ef640fb7818273aec7ff119a69e3f37126978e5ba400d115dd9eeeb1557003a296747a1175c2d079e30235ad5fe7a897ff95acbc2ddae90

Download Submit
C:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INI

Filesize
157B

MD5
ccc3c6a344fe9b7bf0c0c731e2ee0fc5

SHA1
cb0b96e696e85f80e3dca26b75d447ac907b53c7

SHA256
b92115c176b5ece17aacac8aeb34c8d896900a0b592eae290d1d48a35a9f8e44

SHA512
8c0d58688537f4b680407f7b4654568ebe7f0e9c8dea21d47444c4de3f4227efd751c73e10da327feafe757a4d3600238cf965d10af6c2ee88799f86433cb34c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1488793075-819845221-1497111674-1000\4bd07e1ba952c6aa9bf83a8d98c08949_18cc84e5-41c1-45e6-bdc9-06ff0c9e128a

Filesize
54B

MD5
9499c2f308410e48386f58ca7afccd2e

SHA1
e2ef9dec757aec938d801dd720fddc0c387da7af

SHA256
87e4fc1f82d5a89c7f10ca58cf5de66d184cc3ce02954a13ade3100414a3bc97

SHA512
ff68637e2b3b62cf6ca812bf4d067606edacb353825628048396c45e9be8ca7725c93787b8bcf82e610cf795f69a52b20d4ac48ade5405b114643af6515cf457

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton\Norton Download Manager.lnk

Filesize
1KB

MD5
c94436e18b28c6845483c514b1a183c5

SHA1
4838c64a56c032731c2a86c0d613a91252034b8c

SHA256
b027ac670b5ff86599a375fcb8861d05a987470520df38b01c94320f50f7bbe4

SHA512
91edc9bc6afc8e2e080a79fd46c6bba48000e2b564a08bcba3347866a5f1fc2d5fab3d7862b85a2bcb19df37a596ec4b58ac92125d22b345434374a276019e1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton\Norton Installation Files.lnk

Filesize
1KB

MD5
0278d5feb679f0d30e36a2a52bacef1b

SHA1
2006b1b8c9d4c667afef968b4ae1ec980e6de7cf

SHA256
29dd4b68e3323b7beb167058ef2a56f75cfb7bb196a9f3e409c5d1d0fbadad63

SHA512
db8a0bd4f05be1ddd7c3dd717d9cc2505689b4a50e1caef03ba6ec4a1989a1504f5422e1815dbf6042e291bcc087836ba632b2099804a179f59bc5e6e84747b8

Download Submit
C:\Users\Public\Downloads\Norton\{N360620009-SHPD-FSD25037}\ea7937cc603e11f852328f9de4de9a6d_JaffaCakes118.exe

Filesize
809KB

MD5
ea7937cc603e11f852328f9de4de9a6d

SHA1
b3b3e3a122ff144853c834b2d6dcddaed90293df

SHA256
f60a3afd41d56696492565a88d6dab19eedfb4a0ec13f153e37af4548c200acd

SHA512
28337a5a767a8472e8962e17b9dbe7d6ad000cacc00fc774bcafe027256570544e898f9a2ae2924152b05f3ff6fffd5bbd6d292ff6d8d7cb9fa243e67af79722

Download Submit
memory/2388-66-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2388-39-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/2388-32-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/2388-31-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2388-46-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/2388-67-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/2388-76-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/2388-77-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/2408-21-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/2408-30-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/2408-0-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/2408-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2408-16-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads