5da96cb2e7c80092a7256cdda6f6e5bb231e78dfb1d014a62997867e89069ea7

General

Target

281753819babc908151f0627304b86a6_JaffaCakes118.exe
Size

210KB
MD5

281753819babc908151f0627304b86a6
SHA1

fcfb390710f4929f74f55bbae5c9e9a4a39cc147
SHA256

5da96cb2e7c80092a7256cdda6f6e5bb231e78dfb1d014a62997867e89069ea7
SHA512

d0303da62ce5bb9d0f48ef4b7f55ff0cd84dd05a0a1c1455ca2618cd7eac6be76fd78c5edb31ef5e731f6358b3d7db54376f0cf97f4dca94d4092b12cf7423dc
SSDEEP

6144:uYR40sYc3WgFtDNR8r/h7m4vXeAccRIy6+YUd:X2Wc3pDNR+C0eIRLYi

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WINDOWSUPDATE\Parameters\ServiceDll = "C:\\windows\\WINDOWSUPDATE.dll"	281753819babc908151f0627304b86a6_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

pid	Process
1928	281753819babc908151f0627304b86a6_JaffaCakes118.exe
1928	281753819babc908151f0627304b86a6_JaffaCakes118.exe
2520	svchost.exe
2520	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\WINDOWSUPDATE.dll	281753819babc908151f0627304b86a6_JaffaCakes118.exe
File opened for modification	C:\Windows\TAAT.ini	281753819babc908151f0627304b86a6_JaffaCakes118.exe
File created	C:\windows\WINDOWSUPDATE.dll.uns	281753819babc908151f0627304b86a6_JaffaCakes118.exe
File opened for modification	C:\windows\WINDOWSUPDATE.dll	281753819babc908151f0627304b86a6_JaffaCakes118.exe
File opened for modification	C:\windows\WINDOWSUPDATE.dll.uns	281753819babc908151f0627304b86a6_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3148	2520	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	281753819babc908151f0627304b86a6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1928	281753819babc908151f0627304b86a6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2024	1928	281753819babc908151f0627304b86a6_JaffaCakes118.exe	87
PID 1928 wrote to memory of 2024	1928	281753819babc908151f0627304b86a6_JaffaCakes118.exe	87
PID 1928 wrote to memory of 2024	1928	281753819babc908151f0627304b86a6_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\281753819babc908151f0627304b86a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\281753819babc908151f0627304b86a6_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c TATA.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 624
  2⤵
  - Program crash
  PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2520 -ip 2520
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TATA.bat

Filesize
212B

MD5
9f82922d1126b3add835c855ce4d2a13

SHA1
f4eb94187cbffc465e874de69ef9debcaa177130

SHA256
996bdaba6e25c84e099533b14cd9f3491f043008a7982f497d0ca7c364299cf2

SHA512
b3560cb45dd8660001d7ed09902d6e651e81d73f42d4dc328f709a6d9373553597a3dad2e26090b1e13e6043244453b84378f6c1d67e2d76872a58036f5688f2

Download Submit
C:\Windows\TAAT.ini

Filesize
195B

MD5
abf8318ed474028d1a0af661b9523afc

SHA1
d72effd34f912b60e4ce40709ed7d9cb6df71d2a

SHA256
51cafd17b857a57c281fbb755b0cfaff2e2a427588bf29134e6138aa2ef9e317

SHA512
a6868067ee89508193cf95c3743ef826bb4694cfba5cca1141d0b5c7bd267d5f2dfce7996029d0fd24770edd0bbe4c92ce76d25df6d13277726cea90df88f183

Download Submit
C:\Windows\WINDOWSUPDATE.dll

Filesize
205KB

MD5
a38b51a0cdf663dbc1132eb50bb44b27

SHA1
82ef15efcc4881ca2eb22e6f041441c25e26ab76

SHA256
fa91bceb867c74ce901ab56935a814ab5b21e9436b16d42075a244e235896cf8

SHA512
bd59e25efe3ecfb7f3f216c5d6891eeef4434b54ff1d14bc6845b4e09a071ce53261eab7b676b2dd739cfc83027ffc578716e20f7dcabb8edca85130c20c9f44

Download Submit
memory/1928-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1928-2-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1928-1-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1928-3-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1928-18-0x00000000022A0000-0x00000000022DB000-memory.dmp

Filesize
236KB

Download
memory/1928-37-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2520-33-0x00000000011A0000-0x00000000011DB000-memory.dmp

Filesize
236KB

Download
memory/2520-39-0x00000000011A0000-0x00000000011DB000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing