ca8ec89c4c83cb8946015708663d48d86058e7c5c094ce7d56e8ef4bbafa6fcd

General

Target

f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
Size

57KB
MD5

f6bd25e0daf59c7bb733b59416068bd6
SHA1

ef6c28329f60ea7fd067fcd4e0924f166deda48e
SHA256

ca8ec89c4c83cb8946015708663d48d86058e7c5c094ce7d56e8ef4bbafa6fcd
SHA512

e329a6951fbeed6d0c5b42564c37c3ec4fa68842881e22b775b2c0b305fba9bd287c1be09df650c9c0ad7fc85490ff4f9e4b915a740fa0999d70ee0c155a185b
SSDEEP

768:9H/mxdnhVI61Iv3JSHgrhjfvdW1lacva85tZB/CF/2F/:9AdhVx1I/JSHgr1NAlacNtZwQ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1568	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
1568	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
1568	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
1568	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
1568	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Client = "C:\\Windows\\system32\\wuclient.exe"	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XPSP2 Firewall = "C:\\Windows\\system32\\xpsp2fw.exe"	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\-cng-t-c.dll	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wuclient.exe	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rys-l1-nlev.dll	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpsp2fw.exe	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1-0tEfg.dll	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\i-mertCusa.dll	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bilenAct.dll	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wuclient.exe	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsp2fw.exe	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a97e8fab-2fd1-56a5-a3eb-4bf47d6a97e8}	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a97e8fab-2fd1-56a5-a3eb-4bf47d6a97e8}\ = 88996677000000001000000004a0f0d21000000004a0f0d2510000001e000000101000000000000000000000203c21655477760001000000101000000000000000000000783c7c7463655264627000030000001010000000000000000000006368623c7d203c7f7d7467000c00000010100000000000000000000073787d747f50726500110000001010000000000000000000003c727f763c653c7200	f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6bd25e0daf59c7bb733b59416068bd6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\-cng-t-c.dll

Filesize
4KB

MD5
ba2c90b51476a5637b40c1513523e183

SHA1
7d003d422525e794e4ea9eb70aace02c11e7ad9f

SHA256
f7166f71f5bbd5c00fea301d671c2f125bf2bbc326a01038d2afade3d5326980

SHA512
d969e712e66c9d0236ee9f38e4c09626e00c9f247dc5982a4026069c435dac5928f91b084f3edee8f15697f2a8abbfa8c38b929bbc5395569bf64aa56994bf7d

Download Submit
\Windows\SysWOW64\1-0tEfg.dll

Filesize
1KB

MD5
5a1a51f07b19039892d00005921757b7

SHA1
224fc4c9a8354427859b26e8fdf0ce74e78119fd

SHA256
18c9989749906d51b51ba0d7c6f5cfc68d673fc7ae2f22eae376255b5354c7af

SHA512
c57c364f0601306494c19d5fe76f6d01da7e8adabe96a0c421131420164560c415cdf029c9a61bd9b765aeaadd8a922df71d128604385f95b065287f1018e338

Download Submit
\Windows\SysWOW64\bilenAct.dll

Filesize
4KB

MD5
6380abda9712be6706fdbce89c8b4b80

SHA1
83b31e90fc059ec717925137b3f31c9709fefd02

SHA256
d4f6ffa12e91a326d3e34e7cd873f142eec9ff9ece0350139eb491a8b2628f7a

SHA512
0363482461ff29ad604c28a31174abe3542d1109113fbfa1cd80db2433f43adc0a2fc2431386445f56c31368be37fc31fbe268b4ef4755ad2f08a29fc4e62d4a

Download Submit
\Windows\SysWOW64\i-mertCusa.dll

Filesize
9KB

MD5
324349fce2b4bd142b9ae1b15f9c1587

SHA1
96616d42ebd50eb4d68d99fb63fc2e3dd2d34238

SHA256
3429452fb65efc016517501c6481246cbd523d17f0f18ff6e3cf6c549a51fd73

SHA512
5457467aae0a717b0b676d285d591cafa5d99483914cb01efb1cb188b8309f3338fb3f2d09825d1a8b28cb84632f79455e464ca2b02ee71497dd4c757b9edd30

Download Submit
\Windows\SysWOW64\rys-l1-nlev.dll

Filesize
4KB

MD5
167662d438e6d4efd9a0b009ee08173a

SHA1
b808c74d1d690e8941dc9944df5d5f46ef37bc95

SHA256
93d9cd69d8c731a2ed7f394531b5f9671ff3853085c41569c6fb3c29cb06a2b1

SHA512
5a8216b4389e5f7187aefd72dd5f743673f7a1b48befff4c363c3a2a4ab30463822870422e99f314de73d726ee162939437a46aaf4bf59291a605954e10d12e9

Download Submit
memory/1568-11-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1568-14-0x0000000001EC0000-0x0000000001EC4000-memory.dmp

Filesize
16KB

Download
memory/1568-25-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/1568-26-0x0000000001EC0000-0x0000000001EC4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads