f3036870107f97c58ea88766c742f8b7918e204b1094f63058b9f233c0fcdf9c

General

Target

2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe
Size

1.2MB
MD5

2d53830cdda95d72a2ad30bc9a84a453
SHA1

772245d5db549c346a11b8505758e70a58f34cc5
SHA256

f3036870107f97c58ea88766c742f8b7918e204b1094f63058b9f233c0fcdf9c
SHA512

279562dadc062e8b9eaabecb208afbf524baf34b42df3199674b36750fe8c21eb90499816a1b99a8d6b319438099374f460d63c1aa9c76c68821eb756f8d00b3
SSDEEP

24576:4nClh/VaeYg2EtfZ4xj+Y6SUuuOeWaYYA/6y/wml:4nkt9Yg2sfZ4xj+ZRyIE

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1020	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1680	80949131.exe

Loads dropped DLL 4 IoCs

pid	Process
2076	cmd.exe
2076	cmd.exe
1680	80949131.exe
1680	80949131.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\80949131 = "C:\\ProgramData\\80949131\\80949131.exe"	2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\80949131 = "C:\\PROGRA~3\\80949131\\80949131.exe"	80949131.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80949131.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1812	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop	80949131.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\_Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	80949131.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1680	80949131.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	taskkill.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe
1680	80949131.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1020	1656	2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe	28
PID 1656 wrote to memory of 1020	1656	2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe	28
PID 1656 wrote to memory of 1020	1656	2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe	28
PID 1656 wrote to memory of 1020	1656	2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe	28
PID 1020 wrote to memory of 1812	1020	cmd.exe	30
PID 1020 wrote to memory of 1812	1020	cmd.exe	30
PID 1020 wrote to memory of 1812	1020	cmd.exe	30
PID 1020 wrote to memory of 1812	1020	cmd.exe	30
PID 1020 wrote to memory of 2076	1020	cmd.exe	32
PID 1020 wrote to memory of 2076	1020	cmd.exe	32
PID 1020 wrote to memory of 2076	1020	cmd.exe	32
PID 1020 wrote to memory of 2076	1020	cmd.exe	32
PID 2076 wrote to memory of 1680	2076	cmd.exe	33
PID 2076 wrote to memory of 1680	2076	cmd.exe	33
PID 2076 wrote to memory of 1680	2076	cmd.exe	33
PID 2076 wrote to memory of 1680	2076	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\ProgramData\80949131\80949131.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 2d53830cdda95d72a2ad30bc9a84a453_JaffaCakes118.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start C:\PROGRA~3\80949131\80949131.exe /install
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\PROGRA~3\80949131\80949131.exe
      C:\PROGRA~3\80949131\80949131.exe /install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\80949131\80949131.bat

Filesize
304B

MD5
c73208d7772346e896f507de129ac70d

SHA1
443d0f171ecbc6cdb0d597f63280bc9d95bd8d8c

SHA256
e786c7e16da442e8e873bc4386bba4c491492b363735367e200d66f839ba7920

SHA512
768953d018f196a56def23c1e757a434da419da7aa802d410dd55b6be8a4dbb892fc1f0772bdf89278bfa0221e4d8871afb86118d9b37a0fb04a5a261f5e2cd8

Download Submit
\PROGRA~3\80949131\80949131.exe

Filesize
1.2MB

MD5
2d53830cdda95d72a2ad30bc9a84a453

SHA1
772245d5db549c346a11b8505758e70a58f34cc5

SHA256
f3036870107f97c58ea88766c742f8b7918e204b1094f63058b9f233c0fcdf9c

SHA512
279562dadc062e8b9eaabecb208afbf524baf34b42df3199674b36750fe8c21eb90499816a1b99a8d6b319438099374f460d63c1aa9c76c68821eb756f8d00b3

Download Submit
memory/1656-1-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1656-3-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1656-2-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1656-12-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1656-15-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1656-16-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-28-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-36-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-23-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-26-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-24-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-27-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-29-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-34-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-35-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-25-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-38-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-37-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-39-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-40-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-42-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-43-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-44-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-45-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/1680-46-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads