ac24889f515b094fdf81f3d0144fb97357484a5b01bd65ac3e4b68c34b7c28c2

General

Target

2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
Size

151KB
MD5

2d814564ff4574bd423496bdd6105c24
SHA1

235d0914151a37b46178279f4793fc52acad2cfb
SHA256

ac24889f515b094fdf81f3d0144fb97357484a5b01bd65ac3e4b68c34b7c28c2
SHA512

7d1fe28a802738c1a5b212f338d8c8f41b449144e083dac28439225f46edd69d6e24944da7749f9aec968165585200a1188c6d5bec4e63fc5806158a3535ec80
SSDEEP

3072:tAsj8MBX8s0oXJB/sOea7NSnQLz0ZW5DRJCMs3onqr55w3jFTDGW3U:tAsBZjsOunGzL5s/rzwzNDGW3U

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62faeba0.exe	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*2faeba0 = "C:\\Users\\Admin\\AppData\\Roaming\\62faeba0.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\62faeba = "C:\\62faeba0\\62faeba0.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*2faeba = "C:\\62faeba0\\62faeba0.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\62faeba0 = "C:\\Users\\Admin\\AppData\\Roaming\\62faeba0.exe"	explorer.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-addr.es
18	ip-addr.es
185	ip-addr.es

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2380	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
4756	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2268 wrote to memory of 2380	2268	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	86
PID 2380 wrote to memory of 4756	2380	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	87
PID 2380 wrote to memory of 4756	2380	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	87
PID 2380 wrote to memory of 4756	2380	2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe	87
PID 4756 wrote to memory of 1720	4756	explorer.exe	88
PID 4756 wrote to memory of 1720	4756	explorer.exe	88
PID 4756 wrote to memory of 1720	4756	explorer.exe	88

C:\Users\Admin\AppData\Local\Temp\2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2d814564ff4574bd423496bdd6105c24_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demulsifier.dll

Filesize
48KB

MD5
0f7f8bae2118868084d406681891e516

SHA1
85c617dda6681684fc43b072d19b84c5814202ae

SHA256
673c5ad011a6b210b5be729f58ec096133db23d09ee29ab8006dd04e0f107321

SHA512
8b30135f51b8b36f24d0170d615610ce8a5c82d0520b16662e2aa9711074996812f57bb9a6d7202c626f6484c82cb72b3467d469cd395423dd9aa21b6dcc24aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nshA3F3.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
memory/1720-27-0x0000000000A40000-0x0000000000A65000-memory.dmp

Filesize
148KB

Download
memory/1720-28-0x0000000000A40000-0x0000000000A65000-memory.dmp

Filesize
148KB

Download
memory/1720-37-0x0000000000A40000-0x0000000000A65000-memory.dmp

Filesize
148KB

Download
memory/2268-11-0x0000000003010000-0x000000000301D000-memory.dmp

Filesize
52KB

Download
memory/2380-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2380-19-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2380-21-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4756-20-0x00000000010F0000-0x0000000001115000-memory.dmp

Filesize
148KB

Download
memory/4756-23-0x00000000010F0000-0x0000000001115000-memory.dmp

Filesize
148KB

Download
memory/4756-30-0x00000000010F0000-0x0000000001115000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads