dc9dc2f8eb3f92f5f5d6e1cba3105c36ffb4bef786cfade36cd51a32138781de

General

Target

410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe
Size

77KB
MD5

410a4de0f37cbc8c66a856974fc32d7e
SHA1

a360f1770b6ec773199ae0f8fc337e20a765fedc
SHA256

dc9dc2f8eb3f92f5f5d6e1cba3105c36ffb4bef786cfade36cd51a32138781de
SHA512

82d0a4f7e132b8aa0d3f7d96afe90e1283116d28a69b26d1adb6d62bf4ce86a5e5fb7305a53cc7fabc75919c32513c6bc00ae80d1636216a73d7b19cb270dc78
SSDEEP

1536:gG1SnKBRGG93AcGvfE8lSrfxs5iRggeGf02672YjBi6u5wr2z9SRF:gcBRGMAc6fEfjrRdLf0B7/i6u5o3RF

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\lft = "{1df934e4-9571-eac6-a682-9571bc6c3187}"	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
3284	rundll32.exe
3284	rundll32.exe
3284	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\8124.dat	410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ysg.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ysg.dll	rundll32.exe
File created	C:\Windows\SysWOW64\kes.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1df934e4-9571-eac6-a682-9571bc6c3187}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1df934e4-9571-eac6-a682-9571bc6c3187}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1df934e4-9571-eac6-a682-9571bc6c3187}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1df934e4-9571-eac6-a682-9571bc6c3187}\InprocServer32\ = "C:\\Windows\\SysWow64\\gao.tnb"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1df934e4-9571-eac6-a682-9571bc6c3187}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3284	rundll32.exe
3284	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3256	410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3284	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3284	3256	410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe	84
PID 3256 wrote to memory of 3284	3256	410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe	84
PID 3256 wrote to memory of 3284	3256	410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\410a4de0f37cbc8c66a856974fc32d7e_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\8124.dat s
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\8124.dat

Filesize
49KB

MD5
3d37d40d4e48a0b9ae8c3183ad692f47

SHA1
d585237d42278a326e1a6ba53f93cc8b01fb479e

SHA256
a3e9983382349604f89eb54c2f5120fe349e5dd4c22240977fb4d46324e1c910

SHA512
15560e5da05d8606d9e400bc951da515c4ff02ef60220dfb2e3163e4769cef4bad9ad3dbdf220551da8f34d41ab74d2f51aa82970931c5c30756cb583394b1ea

Download Submit
C:\Windows\SysWOW64\kes.dll

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Windows\SysWOW64\ysg.dll

Filesize
478KB

MD5
e99416267b61f52fa5ab994019efd359

SHA1
86d31eae707db7fe51d2556394fcf0e8e9f6b0fd

SHA256
768c286674371564b5e6095edb56e0a4231f341be895da69cfccca5160029774

SHA512
0a1c7579a9c787c2c1bef35f0660e72e74b42824e14ebea63b87ed25ddaf107e3746567bb431cab41a2f6719fad2c22d96e0715a1fe085d75805d7d66f7f05ae

Download Submit
memory/3256-1-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/3256-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3256-25-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3256-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3284-7-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3284-8-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/3284-20-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/3284-21-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/3284-6-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3284-23-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/3284-22-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads