9b09a6c6f6de2cae2eecdb7663ebd65f160dd7048a709321587d8079d992826f

General

Target

fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
Size

398KB
MD5

fa725cb334d4982c5cd755b232890387
SHA1

d914917ee7570a2e89ebd3ea0db205e4df6abdc0
SHA256

9b09a6c6f6de2cae2eecdb7663ebd65f160dd7048a709321587d8079d992826f
SHA512

3cba9b80083e7fb15b21c4108266fb989092da161795c1b5c8fdfa16f0899c03b76689492876af7c9ac769d3b4c9038d8b08774b1ccfe3328243d0b79eebde58
SSDEEP

6144:vZ2RPEwVTR0oV/IF2idZecnl20lHRxp3gq6H4fdCIxwuaWS62YPyqz+KaFjy3463:vZ0PEwj0CQF3Z4mxxGy76DpFjyo6hzN

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 6 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	1.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	1.exe

Loads dropped DLL 5 IoCs

pid	Process
2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
2748	1.exe
2748	1.exe
2776	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\racer.dll	1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2748	2104	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k racer
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe

Filesize
41KB

MD5
81a7d2edd06eb261380eaa6a35b03cd4

SHA1
02c353c55e77e429fe95cf015d1c3545f536bb5b

SHA256
484bd45a66970c4d24be5b1e30322194d6e40370eed68c259559a8c462851282

SHA512
15f799d5230c29d87ca24dc8bb94f55b639b6b52f26dfbfc169a8756dc2088d6947596f501e18e37b7857f160470554548270747382cd182dfe36a7726e56740

Download Submit
\Windows\SysWOW64\racer.dll

Filesize
57KB

MD5
56b8b71e0218864919928caf1326b2c5

SHA1
a0231668d13305d3aa180098969bd627db5417a1

SHA256
08fd324d566e64a9fed875762b115e9e7e51857e387baef7c3a8d64bd97fed73

SHA512
602e8ca1740b379894dfb623b032df3ca731fb78f0fbe59616df89d7cc6423b2037f064aac0f80e70a84ab631455c60de8d1abb05a45fabdfa46967e9d29a950

Download Submit
memory/2104-0-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/2104-2-0x000000000101E000-0x000000000101F000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x0000000000720000-0x0000000000791000-memory.dmp

Filesize
452KB

Download
memory/2104-3-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/2104-4-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/2104-22-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/2748-21-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads