ba44004d91ec1914e9ebf44239c2429244ecf9a14e3666fae4b45f4f1d34daf6

General

Target

1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
Size

281KB
MD5

1355d10d18af19532743d033cc8e2cda
SHA1

345a6d9ff44581ba1182054d023e1eb31badd2b3
SHA256

ba44004d91ec1914e9ebf44239c2429244ecf9a14e3666fae4b45f4f1d34daf6
SHA512

6d9188402c4c6270cfee28b7a02e59cdf2344abc1b568e5068dd8db6b7ecd22ac47e4c562b0cdf70fcfb6cbd43bff37fe2624e36e5a7d6d473f619ab3fd9fd80
SSDEEP

6144:MNmZjCnD89otkjn7RRRJRRRRRdRRRJRRRdRRRVRRRdRRR5RRRRRdRRRRRRRRRdRl:MUVJsXbGO4FYvw

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1912	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
2648	taskmgr.exe
1332	taskmgr.exe

Loads dropped DLL 3 IoCs

pid	Process
2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\TaskMgr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\taskmgr.exe"	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\TaskMgr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\taskmgr.exe"	taskmgr.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2648 set thread context of 1332	2648	taskmgr.exe	36

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
2648	taskmgr.exe
1332	taskmgr.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2348 wrote to memory of 2824	2348	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	31
PID 2824 wrote to memory of 1912	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	33
PID 2824 wrote to memory of 1912	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	33
PID 2824 wrote to memory of 1912	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	33
PID 2824 wrote to memory of 1912	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	33
PID 2824 wrote to memory of 2648	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	35
PID 2824 wrote to memory of 2648	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	35
PID 2824 wrote to memory of 2648	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	35
PID 2824 wrote to memory of 2648	2824	1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe	35
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36
PID 2648 wrote to memory of 1332	2648	taskmgr.exe	36

C:\Users\Admin\AppData\Local\Temp\1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="TaskMgr" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Microsoft\taskmgr.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1912
- - C:\Users\Admin\AppData\Roaming\Microsoft\taskmgr.exe
    /d/C:\Users\Admin\AppData\Local\Temp\1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Roaming\Microsoft\taskmgr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\taskmgr.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1355d10d18af19532743d033cc8e2cda_JaffaCakes118.exe

Filesize
281KB

MD5
1355d10d18af19532743d033cc8e2cda

SHA1
345a6d9ff44581ba1182054d023e1eb31badd2b3

SHA256
ba44004d91ec1914e9ebf44239c2429244ecf9a14e3666fae4b45f4f1d34daf6

SHA512
6d9188402c4c6270cfee28b7a02e59cdf2344abc1b568e5068dd8db6b7ecd22ac47e4c562b0cdf70fcfb6cbd43bff37fe2624e36e5a7d6d473f619ab3fd9fd80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\G31p0GtHF66k0

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Q36Nl

Filesize
105B

MD5
9e16bb516930504a4a8832c4d480889e

SHA1
e091baf84b8d48f469fdd240d4aab7a661e3ada0

SHA256
1d628abb7417054f1c0d61bf4a19fda3076fba138773341b69885ec76078007b

SHA512
43cfdac144455cf0930add66c39ca83603635ca04644f8e3e652a9d3d063007ad05bfbc67b31014fad368010eaa2a8c84c4208f101e30ffd8f87f0bd8d2bb1d4

Download Submit
memory/1332-163-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1332-160-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1332-157-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1332-154-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1332-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2348-32-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2348-26-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/2824-49-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2824-80-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2824-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2824-41-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2824-43-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2824-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2824-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads