d9110e6cee9693adacf497a91f8c2dd925ceb61c3981f8782173244a3b5d4c84

General

Target

2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe
Size

82KB
MD5

2cee37fa40efa4db1eab5b5169684d8e
SHA1

38496f3fe613ba3cb4b4437cde3b2e9cd76e68b0
SHA256

d9110e6cee9693adacf497a91f8c2dd925ceb61c3981f8782173244a3b5d4c84
SHA512

0c4248338a3330aec1d5ee7c8fb92d71a9269e47c076afb4eecbeee010d34f6ef982a4e7b41d058c03c4a9fd720c2c5842fbfe17a8cf782bc234458716dc0985
SSDEEP

1536:n5neEhlcTW5sk1jtf2XvWINndIcN6JhLs5g7EPXOteSx0cw1yA02:5nj9jtfU+INndIc0JW5imCbLgyA02

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
320	server.exe
952	23.exe
2760	iexplore.exe

Loads dropped DLL 6 IoCs

pid	Process
2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe
2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe
320	server.exe
320	server.exe
320	server.exe
952	23.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows Live Messenger = "iexplore.exe"	23.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\iexplore.exe	23.exe
File opened for modification	C:\Windows\iexplore.exe	23.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
320	server.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 2368 wrote to memory of 320	2368	2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe	30
PID 320 wrote to memory of 952	320	server.exe	31
PID 320 wrote to memory of 952	320	server.exe	31
PID 320 wrote to memory of 952	320	server.exe	31
PID 320 wrote to memory of 952	320	server.exe	31
PID 320 wrote to memory of 952	320	server.exe	31
PID 320 wrote to memory of 952	320	server.exe	31
PID 320 wrote to memory of 952	320	server.exe	31
PID 952 wrote to memory of 2760	952	23.exe	32
PID 952 wrote to memory of 2760	952	23.exe	32
PID 952 wrote to memory of 2760	952	23.exe	32
PID 952 wrote to memory of 2760	952	23.exe	32
PID 952 wrote to memory of 2760	952	23.exe	32
PID 952 wrote to memory of 2760	952	23.exe	32
PID 952 wrote to memory of 2760	952	23.exe	32

C:\Users\Admin\AppData\Local\Temp\2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cee37fa40efa4db1eab5b5169684d8e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\23.exe
    C:\Users\Admin\AppData\Local\Temp\23.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\iexplore.exe
      "C:\Windows\iexplore.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\23.exe

Filesize
27KB

MD5
15c8b6c06fe7d4355b13550a368ed67b

SHA1
a56f03002254f9613503316793bfbac2b730de1b

SHA256
3f2c1c1a920d5cbe99c6633c98789d370993d125d4ca7ef4feecdd24eea8f93b

SHA512
a16707b447de57baed4e89b1aada0d3a2c1c605f7c3ed63784ac1b6e501326a1e2c9444fadfdfd4a3f2aad5661c26c2c13b473282912f4831e444d256e1997e7

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
47KB

MD5
fb2ddbc8fb7210f2b43c009fce97c36e

SHA1
2b33e6b3bf9cb56d3132eadd7780e2a3489f1151

SHA256
da569deee79d3ba0a112ff576987d3f6250653ea7867d41e3bf7fdd61261d379

SHA512
c64f4b9f0240bdd2650ecb999af4cb95373cf3b04f2c2a763375f0b752266b2c9f83b328f023968dd2558108810311a5eb7f803461bd691c7adec2cc8488c78b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads