14d9d0befaeff447aac0cdd48e07e1da5c1b70797c1aaa691a402f9705de2575

General

Target

eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe
Size

46KB
MD5

eb8f1bc27400d65cd9cac6b8bf3be118
SHA1

c7a1c719d6cb9d61df07a55ef43054cd0c2f97c0
SHA256

14d9d0befaeff447aac0cdd48e07e1da5c1b70797c1aaa691a402f9705de2575
SHA512

b09e710781fd3f5efd625cf5bc2e9eefc7a24ec7a51180b8f2976abb673dd98e2339c72d983c35df73b878c8f333d561334f259bf989ae22e876bce5f3e26d73
SSDEEP

768:ZSd3AsrIXEh8WfsztZGBYKu9G/ZyTZj1urLdHjsdwOhme/O2MFn4LXx:/Iomsztd2l3lsmOhmyO1Fn49

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\IEHost2Services\Parameters\ServiceDll = "C:\\Windows\\system32\\IEHost2Services.dll"	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2328	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2836	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IEHost2Services.dll	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8E8D3A99-D70A-4C07-9E10-A481F371B7C3}\fe-bc-6d-92-53-7b	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ce000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8E8D3A99-D70A-4C07-9E10-A481F371B7C3}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8E8D3A99-D70A-4C07-9E10-A481F371B7C3}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bc-6d-92-53-7b	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8E8D3A99-D70A-4C07-9E10-A481F371B7C3}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bc-6d-92-53-7b\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8E8D3A99-D70A-4C07-9E10-A481F371B7C3}\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bc-6d-92-53-7b\WpadDecisionTime = 006fe61fa30adb01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8E8D3A99-D70A-4C07-9E10-A481F371B7C3}\WpadDecisionTime = 006fe61fa30adb01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-bc-6d-92-53-7b\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3060	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2328	3060	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2328	3060	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2328	3060	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe	30
PID 3060 wrote to memory of 2328	3060	eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb8f1bc27400d65cd9cac6b8bf3be118_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EB8F1B~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k IEHost2Services
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\IEHost2Services.dll

Filesize
23KB

MD5
8fa045eff2d3ba799983dc7dd6087508

SHA1
10b46cc82919c42e93f73a20d236b8e3c3030a13

SHA256
ba9d662ddaa36e18275936b7caae69b668a418ed63b9db5173dda6a024065d00

SHA512
d9b7e3939efdb4311283f88d7066ea428cb0c7e94a56864929b483fb0758bb0e32a9bacc1a1022703e8c26ac3c955a7a52ca66bd14f05596a327f19ff648ef30

Download Submit
memory/2836-10-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2836-18-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2836-17-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2836-14-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2836-16-0x0000000010006000-0x0000000010007000-memory.dmp

Filesize
4KB

Download
memory/2836-13-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3060-3-0x000000000040B000-0x000000000040C000-memory.dmp

Filesize
4KB

Download
memory/3060-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3060-2-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3060-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3060-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3060-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing