f33b58e9772f02c8e542e12866b92c753aee36e528c85eb90e5260627c1ee24d

General

Target

28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Size

35KB
MD5

28ef1381abd8293b232ccc9365b3787a
SHA1

88155efd551b9c870f6183162cefdd287cda6b81
SHA256

f33b58e9772f02c8e542e12866b92c753aee36e528c85eb90e5260627c1ee24d
SHA512

0634ad7fd1f1d9352a1777e23b05a1d91c004a6d71fc15fd9a77a43febbd4f8fb4713006a6bac7394d86cea98acdeed9324d2bf140c6c70c30b615bdcfaf580b
SSDEEP

768:IXOg/iBUEaz0mbYUvRfWJPRI7DEvRXp00lOj:D0iLCYGfWJ5I7UXpjk

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\oyfwria = "c:\\windows\\kqxswnj.exe"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1456-0-0x0000000000010000-0x000000000002C000-memory.dmp	upx
behavioral1/memory/1456-5-0x0000000000010000-0x000000000002C000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\kqxswnj.exe	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
File opened for modification	\??\c:\windows\kqxswnj.exe	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://w-find.com/sp.htm"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://w-find.com/"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://w-find.com/sp.htm"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchURL	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchUrl\provider = "w-find.com"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\VerKey3 = "nro\|aizz}ullydjfo={_oztlnqag{r\x7fzjv~_~ndtg{bvtz{qzma1sht{ph"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\{A3DFD66B-F281-421A-B922-426C75E19F06} = "1763200032"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\{34CEC74F-8ECF-4125-ACF5-D2CD5F6B0715} = "1763200032"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\VerKey3Prev = "du\|sxfco}{sacmqfe=y_ex\|vlhrutvb_xdqgpphllqp_\x7fdssps\|gld\|wsdv_hofryfvdcob_gwthapds\|_k5q;\x7fhjic4k6w;o4kdbewg{;y5}<k6pem5b6{5hf{fdfr<y6x9z8zeg6a:a;}:\x7fdwbsmndqiqivdzfidynlhsvf4j4l;w1shu{bh"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Use Search Asst = "no"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchUrl\ = "http://w-find.com/"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://w-find.com/"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-0-0x0000000000010000-0x000000000002C000-memory.dmp

Filesize
112KB

Download
memory/1456-5-0x0000000000010000-0x000000000002C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.