b05797ed3e7696c4996aac47d2185c65692d0139c137e9a08ed80b25b7eba5fd

General

Target

08350d5087b6df64ebfd9f4f8c532ea4_JaffaCakes118.exe
Size

94KB
MD5

08350d5087b6df64ebfd9f4f8c532ea4
SHA1

a5effcc2919d2b0043795034e9c8eb27fb23bceb
SHA256

b05797ed3e7696c4996aac47d2185c65692d0139c137e9a08ed80b25b7eba5fd
SHA512

7e9262a3ee36012c483ae9eb79bb1fcaca5f0b1fdabe37bead75895e5f716f66fe6b0b3eea749ebfc43f631a4055bbe1e90ded180fd58f57538bb90033874e29
SSDEEP

768:zyIwQJYM3srWqaVC+HKvu1rrnQe22IR7WHJ8Fjh7hQzTGfL7YmcZn5mmZn:zyIwQJYZW14+q21rjTW/zQkOv

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	svchost.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\RLT6990\services.exe	08350d5087b6df64ebfd9f4f8c532ea4_JaffaCakes118.exe
File created	C:\Windows\Drv15\svchost.exe	08350d5087b6df64ebfd9f4f8c532ea4_JaffaCakes118.exe
File created	C:\Windows\TDTMP	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1672	2544	taskeng.exe	31
PID 2544 wrote to memory of 1672	2544	taskeng.exe	31
PID 2544 wrote to memory of 1672	2544	taskeng.exe	31
PID 2544 wrote to memory of 1672	2544	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\08350d5087b6df64ebfd9f4f8c532ea4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08350d5087b6df64ebfd9f4f8c532ea4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:2280

C:\Windows\system32\taskeng.exe
taskeng.exe {177444BE-C614-43D0-9369-DE2C3971A195} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\Drv15\svchost.exe
  C:\Windows\Drv15\svchost.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Drv15\svchost.exe

Filesize
31KB

MD5
752d8243ffe4b40c0b319c3230ee9d8c

SHA1
6cec57cf5aefdc8d77ae04c2b7a7efe153cbe28f

SHA256
1fc90085844edbe2d7e18ee187cb143de66144602fed0197c16245dfe0ad136b

SHA512
d75177704abd0f3feb1482a34b36b7d914863b2185a16ce47c2e1071c9e37ae41ebd54a266ec8f51011aa6755afc8c3d6deb2b9c61c2d2d59255e66df55c3470

Download Submit
C:\Windows\RLT6990\services.exe

Filesize
94KB

MD5
08350d5087b6df64ebfd9f4f8c532ea4

SHA1
a5effcc2919d2b0043795034e9c8eb27fb23bceb

SHA256
b05797ed3e7696c4996aac47d2185c65692d0139c137e9a08ed80b25b7eba5fd

SHA512
7e9262a3ee36012c483ae9eb79bb1fcaca5f0b1fdabe37bead75895e5f716f66fe6b0b3eea749ebfc43f631a4055bbe1e90ded180fd58f57538bb90033874e29

Download Submit
memory/1672-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1672-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1672-17-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2280-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2280-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing