f33b58e9772f02c8e542e12866b92c753aee36e528c85eb90e5260627c1ee24d

General

Target

28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Size

35KB
MD5

28ef1381abd8293b232ccc9365b3787a
SHA1

88155efd551b9c870f6183162cefdd287cda6b81
SHA256

f33b58e9772f02c8e542e12866b92c753aee36e528c85eb90e5260627c1ee24d
SHA512

0634ad7fd1f1d9352a1777e23b05a1d91c004a6d71fc15fd9a77a43febbd4f8fb4713006a6bac7394d86cea98acdeed9324d2bf140c6c70c30b615bdcfaf580b
SSDEEP

768:IXOg/iBUEaz0mbYUvRfWJPRI7DEvRXp00lOj:D0iLCYGfWJ5I7UXpjk

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplvlp = "c:\\windows\\dukgndp.exe"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1360-0-0x0000000000010000-0x000000000002C000-memory.dmp	upx
behavioral2/memory/1360-5-0x0000000000010000-0x000000000002C000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\dukgndp.exe	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
File opened for modification	\??\c:\windows\dukgndp.exe	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\SearchURL\provider = "w-find.com"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "http://w-find.com/sp.htm"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VerKey3 = "vzzpks\|oryuoescfu=~_\|zalwq\x7fggrhz~vs_\|gnxwn\x7fjkqcgxsz1vho{nh"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\{34CEC74F-8ECF-4125-ACF5-D2CD5F6B0715} = "1763200004"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VerKey3Prev = "vtu\|}}em~p}kkrhfl=s_ixrvdh~uivc_fdkgipmlmqz_edvs~sighdpwlde_poxrrf}dcoc_owjhppfs{_c5b;dhmiw4t6r;f4{d}ejga;b5g<z6ret5c6w5vf\|fifz<\|6h9g8}ea6m:u;d:mdbb}m~dzicixdufwdnnehhvp4l4b;w1aht{lh"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\SearchURL\ = "http://w-find.com/"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\SearchURL	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\{A3DFD66B-F281-421A-B922-426C75E19F06} = "1763200004"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://w-find.com/"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://w-find.com/sp.htm"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://w-find.com/"	28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28ef1381abd8293b232ccc9365b3787a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-0-0x0000000000010000-0x000000000002C000-memory.dmp

Filesize
112KB

Download
memory/1360-5-0x0000000000010000-0x000000000002C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads