638b91a6a31f885370ec2bf325e66683050cc675ebbfab6e7b726e18e3a4070b

General

Target

fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Size

36KB
MD5

fe4baf0161dd5b7408dd2d41e64843fe
SHA1

75db56ae6754bbc97845ba470e80bc779685cde1
SHA256

638b91a6a31f885370ec2bf325e66683050cc675ebbfab6e7b726e18e3a4070b
SHA512

f9f2f510545418ff38b33cfb517fc276da81415abfa38015af074037106dea722ad7a39a59301e25fd6d5ee19bfd32aecfe0bc89631b3dcf4d45c02da07f7644
SSDEEP

384:/TlCPkepDT6x0121Uc4rcGgiB7bwCrp/Ovw5ITvmPWvvDWSyWN:/B+kepkmrcDIbwCrRITvmPWTRZ

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "notepad.exe"	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "notepad.exe"	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\Debugger = "notepad.exe"	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "notepad.exe"	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "notepad.exe"	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wintask = "c:\\wintask8201.exe"	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\p4kl3k.html	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.ppt.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.ppt.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.ppt.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.ppt.exe	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
File created	\??\c:\windows\p4kl3k.html	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe4baf0161dd5b7408dd2d41e64843fe_JaffaCakes118.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\p4kl3k.html

Filesize
160B

MD5
bea6c6dd1eb3f3277b4a68731f9abd23

SHA1
0cfe5c88ec54540b8a0602f5e6e8ae789ede7291

SHA256
570e8068e5a57a90f916b8d2a8e5aeaa39dd962f11d569ccd7302a83673635aa

SHA512
4c7d5c49943d8c4831be23cdf32cf9ee571f0e48ee4d12ef1af104ecfdc25dabe96afab8211948c6dd24c4092678d7d3f505722183be5ad3a740cbcbc56de731

Download Submit
C:\winph.sys

Filesize
36KB

MD5
fe4baf0161dd5b7408dd2d41e64843fe

SHA1
75db56ae6754bbc97845ba470e80bc779685cde1

SHA256
638b91a6a31f885370ec2bf325e66683050cc675ebbfab6e7b726e18e3a4070b

SHA512
f9f2f510545418ff38b33cfb517fc276da81415abfa38015af074037106dea722ad7a39a59301e25fd6d5ee19bfd32aecfe0bc89631b3dcf4d45c02da07f7644

Download Submit
memory/2420-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2420-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads