e39833957b0f9e99d6d2a4c6ce4c28c63f6b083fb5fdded4da7dd3f8eb1c7846

General

Target

ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe
Size

361KB
MD5

ebc9244e86cc5318d09bf062c67084c2
SHA1

43cc09cd651af0d0ca4635385dfb4b796085cbda
SHA256

e39833957b0f9e99d6d2a4c6ce4c28c63f6b083fb5fdded4da7dd3f8eb1c7846
SHA512

afdf45dffb3ec3e18d9a9ce3368db16d9594afa8eaad90d7fd64ed90144331ec8021be4b72349f3d35ed76d1bb14dd81b30a8fc3c9abb1334da79bafb63ed9df
SSDEEP

6144:QGs4XwY/HPJ6xzJ44nDWgRAkPUfGQn8xID0DMF+soQWqFqEYXqZwGPmf34fuDpbb:U4XF/H0dJR3PUfGLxe0Dlsfxq5XH3ygb

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\bits.dll"	server.exe

Executes dropped EXE 1 IoCs

pid	Process
4456	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bits.dll	server.exe
File opened for modification	C:\Windows\SysWOW64\bits.dll	server.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4456	812	ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe	82
PID 812 wrote to memory of 4456	812	ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe	82
PID 812 wrote to memory of 4456	812	ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebc9244e86cc5318d09bf062c67084c2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
112KB

MD5
59efb24abe53baf9a725be4c73b368c3

SHA1
e06fbac39bd52606666eef5aac2bd9a7e4247e5e

SHA256
e3f9c3131045da00a6b53cbc183e32b755f2a1c0ad8ac5e30299a17ee734a1e1

SHA512
f17222696c8d6b67a94427637ddaf4927c32c7adc017e73ad5ac7b6760114a65cadca31b469b0bd213208e38e2504e2faaefc148754c7578cbbfc6824373c490

Download Submit
C:\Users\Admin\AppData\Local\Temp\release.tmp

Filesize
87KB

MD5
e8b8836b71d6b542b06e016dc8b88e2d

SHA1
5ba23e4dbf17b0440474df801fa46d513f263741

SHA256
f5ddaca68aaae1bf8a3753cb12785e19a2aba9fcb17b166a66f00a0e3995fd34

SHA512
6a37f5d14c87b204d5041d86ae19046124f47ddd2b4a15e6bb4c74e9f1cbe5f4c53fc18e3c0118484197b81c705ddf4bc41be6edf813b37909627ad952857f5e

Download Submit
memory/812-5-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/812-6-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-9-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-11-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-10-0x0000000001001000-0x000000000100B000-memory.dmp

Filesize
40KB

Download
memory/812-2-0x0000000000650000-0x000000000069A000-memory.dmp

Filesize
296KB

Download
memory/812-31-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-29-0x0000000000650000-0x000000000069A000-memory.dmp

Filesize
296KB

Download
memory/812-8-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-7-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-0-0x0000000001000000-0x000000000107E000-memory.dmp

Filesize
504KB

Download
memory/812-4-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/812-3-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/812-1-0x0000000000650000-0x000000000069A000-memory.dmp

Filesize
296KB

Download
memory/4456-28-0x0000000000400000-0x000000000041C2E0-memory.dmp

Filesize
112KB

Download
memory/4456-19-0x0000000000400000-0x000000000041C2E0-memory.dmp

Filesize
112KB

Download
memory/4456-20-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads