71a8f67057bbb7d82574fc706d76b33f9bf666746c1815c1836b72cc4266bb55

General

Target

0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe
Size

479KB
MD5

0847ec1b65b0a0fd9b3bd233a242cc30
SHA1

6395f50c187b25ac8ac96c98c7c99c264035b1a1
SHA256

71a8f67057bbb7d82574fc706d76b33f9bf666746c1815c1836b72cc4266bb55
SHA512

249d2b031a79e8fd3333e215a2af48c29052add1d5a037279f8ebe34e927d08607d9b0b03dfd12ae16f4965c7cbe4433c46bc06fcadf534f724e62ce45ef448f
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3656	0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3656	0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe
3656	0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0847ec1b65b0a0fd9b3bd233a242cc30_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3000,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\ActionEngine.dll

Filesize
1009KB

MD5
9f33f5afe6693f5ef2bab1ff9b68ca52

SHA1
01b12b2c2b389d2337548b6d41a11be4516d8039

SHA256
7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced

SHA512
221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\Gui\api.js

Filesize
5KB

MD5
cad20144ce29f20fecd6c21c5c61dead

SHA1
6bbaeb0aae32a3828cb77f8bfd3fb493803f3626

SHA256
e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80

SHA512
35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\Gui\jquery-1.3.2.min.js

Filesize
55KB

MD5
bb381e2d19d8eace86b34d20759491a5

SHA1
3dc9f7c2642efff4482e68c9d9df874bf98f5bcb

SHA256
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899

SHA512
abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\Gui\jquery.localisation.min.js

Filesize
1KB

MD5
f1cf73e00c240e9a4283201291d45a07

SHA1
918c49cb6f1de521d91967b2508f19db1f38fea2

SHA256
81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2

SHA512
2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\Gui\splash.html

Filesize
1KB

MD5
0d0e0532f51af856688ad83abb889fde

SHA1
a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c

SHA256
a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8

SHA512
29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\Gui\splash.js

Filesize
946B

MD5
354dce57695e99df9e6faba76346496f

SHA1
ca364e2daa4a80cfed7412b0f0374f1f82fa7146

SHA256
bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823

SHA512
8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\Gui\translation.js

Filesize
6KB

MD5
682fea27f4c335defc18be6fb24d5748

SHA1
d4a1743d63508d18af4be59232f3d266228648fb

SHA256
928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f

SHA512
ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_582D.tmp\instlangs.xml

Filesize
17KB

MD5
aa91818150cfadb667ae6f914d43dca0

SHA1
4411bd0038ccd464ed7597f0540cfe04867b9042

SHA256
2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5

SHA512
dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd

Download Submit
memory/3656-104-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/3656-151-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing