9b09a6c6f6de2cae2eecdb7663ebd65f160dd7048a709321587d8079d992826f

General

Target

fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
Size

398KB
MD5

fa725cb334d4982c5cd755b232890387
SHA1

d914917ee7570a2e89ebd3ea0db205e4df6abdc0
SHA256

9b09a6c6f6de2cae2eecdb7663ebd65f160dd7048a709321587d8079d992826f
SHA512

3cba9b80083e7fb15b21c4108266fb989092da161795c1b5c8fdfa16f0899c03b76689492876af7c9ac769d3b4c9038d8b08774b1ccfe3328243d0b79eebde58
SSDEEP

6144:vZ2RPEwVTR0oV/IF2idZecnl20lHRxp3gq6H4fdCIxwuaWS62YPyqz+KaFjy3463:vZ0PEwj0CQF3Z4mxxGy76DpFjyo6hzN

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 6 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	1.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\racer\Parameters\ServiceDll = "%SystemRoot%\\System32\\racer.dll"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
5116	1.exe

Loads dropped DLL 2 IoCs

pid	Process
5116	1.exe
1040	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\racer.dll	1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5116	5064	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	82
PID 5064 wrote to memory of 5116	5064	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	82
PID 5064 wrote to memory of 5116	5064	fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa725cb334d4982c5cd755b232890387_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5116

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k racer
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe

Filesize
41KB

MD5
81a7d2edd06eb261380eaa6a35b03cd4

SHA1
02c353c55e77e429fe95cf015d1c3545f536bb5b

SHA256
484bd45a66970c4d24be5b1e30322194d6e40370eed68c259559a8c462851282

SHA512
15f799d5230c29d87ca24dc8bb94f55b639b6b52f26dfbfc169a8756dc2088d6947596f501e18e37b7857f160470554548270747382cd182dfe36a7726e56740

Download Submit
C:\Windows\SysWOW64\racer.dll

Filesize
57KB

MD5
e2bb2d7a11b8f48c392086ef49049846

SHA1
c0ae238de5e6409e76ecbe398a0bbf35fe57b4b5

SHA256
c7ec09c92b3236f3234125e366375e3c4373598874b159f603e3fde9144b9dac

SHA512
6595022214e700201780ae3dc4e3e8929847a203cbf70ee050d637c7bb15969797bd54398cf8106b18341a411e48cbc90cbe35045a5efa1924f40464fbd0599f

Download Submit
memory/5064-0-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5064-1-0x000000000101E000-0x000000000101F000-memory.dmp

Filesize
4KB

Download
memory/5064-2-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5064-3-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5064-4-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5064-10-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5064-20-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5064-19-0x0000000001000000-0x0000000001071000-memory.dmp

Filesize
452KB

Download
memory/5116-17-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads