e3590f7fc31b1e70417709c1850aed38d6012fbddf7f5c8b8e94a66b10ef43c0

General

Target

29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Size

220KB
MD5

29bfe33df6238ddf2dc6d9c19460c400
SHA1

b3476af8e9c5a48681295253d83839a1f4010acf
SHA256

e3590f7fc31b1e70417709c1850aed38d6012fbddf7f5c8b8e94a66b10ef43c0
SHA512

15e346e13c4fe4d14181379ea866c35927a013acf66f95a088db2bcb5a8a87e89a1a1801c3ca8d12a6934aa9bf6cd621d4f3c53014707349095f31ea20995469
SSDEEP

3072:poRiEYKHmZtxKm9tWMF4c1D4iNbgpBw9qoh0zta1b9B5Pq8NciPq:pyHulTpspBXo2zta1b9+hX

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 16 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\HDaudio.exe = "C:\\Windows\\HDaudio.exe:*:Enabled:Explorer"	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\:TCP = ":TCP:*:Enabled:Explorer"	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	HDaudio.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\HDaudio.exe = "C:\\Windows\\HDaudio.exe:*:Enabled:Explorer"	HDaudio.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	HDaudio.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\:TCP = ":TCP:*:Enabled:Explorer"	HDaudio.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	HDaudio.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	HDaudio.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	HDaudio.exe

Executes dropped EXE 1 IoCs

pid	Process
4232	HDaudio.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\High Defination Audio = "C:\\Windows\\HDaudio.exe"	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	HDaudio.exe

Drops autorun.inf file 1 TTPs 8 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\c:\Autorun.inf	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
File opened for modification	\??\c:\Autorun.inf	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
File created	\??\f:\Autorun.inf	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
File opened for modification	\??\f:\Autorun.inf	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
File opened for modification	\??\c:\Autorun.inf	HDaudio.exe
File created	\??\c:\Autorun.inf	HDaudio.exe
File opened for modification	\??\f:\Autorun.inf	HDaudio.exe
File created	\??\f:\Autorun.inf	HDaudio.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\HDaudio.exe	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
File opened for modification	C:\Windows\HDaudio.exe	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
File opened for modification	C:\Windows\par.txt	HDaudio.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDaudio.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3156	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
4232	HDaudio.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4232	3156	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe	84
PID 3156 wrote to memory of 4232	3156	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe	84
PID 3156 wrote to memory of 4232	3156	29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29bfe33df6238ddf2dc6d9c19460c400_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\HDaudio.exe
  C:\Windows\HDaudio.exe
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Autorun.inf

Filesize
275B

MD5
251b351cfa7174f42727a48e15462501

SHA1
8b0476d2ce63514d379c85a5aeab2e60a4935086

SHA256
a163429cb6eeaedce1b03b0e28f264b7ac4658187199cc95202a9d3d0062884c

SHA512
eb6124d914ee0fa135bd8c985b56f6ca1a843942742f5e2d87c94a8bf2bf20c6eb557837cc3abdfde05de810d54521fb8c267a3c6572a37c6550aef338ae89c7

Download Submit
C:\Windows\HDaudio.exe

Filesize
220KB

MD5
29bfe33df6238ddf2dc6d9c19460c400

SHA1
b3476af8e9c5a48681295253d83839a1f4010acf

SHA256
e3590f7fc31b1e70417709c1850aed38d6012fbddf7f5c8b8e94a66b10ef43c0

SHA512
15e346e13c4fe4d14181379ea866c35927a013acf66f95a088db2bcb5a8a87e89a1a1801c3ca8d12a6934aa9bf6cd621d4f3c53014707349095f31ea20995469

Download Submit
memory/3156-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3156-20-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4232-30-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads