aa462e1ee230522ac0eb40139c806291076b95e32fb8b14b97ec5b22cafc8b0f

General

Target

452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Size

79KB
MD5

452d375b35e91bf3d59d8538c17aab40
SHA1

8f4f9568cf8917b7b369e8242fcc457061340e26
SHA256

aa462e1ee230522ac0eb40139c806291076b95e32fb8b14b97ec5b22cafc8b0f
SHA512

4ed89e990bbb92bf1041ba1e5eb1f51055b590c15179f7244011eb861ab3052819554c224aa93f06e795a204c39f9ca643b34845ccd1bae23dd078ed88843ce4
SSDEEP

1536:gJRE0MupgohzRg60D9mJaD+BC3KH7NeYRNvfv7T7ol3ALg:gXu/MVID9mJA+BC3K5eqjox6g

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2644	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\UWK\iexplore.exe	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\Æô¶¯Internet Explorer(&H)\Command	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\ÊôÐÔ(&R)	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\ = "Æô¶¯Internet Explorer(&H)"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\ = "HideOnDesktopPerUser"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "0"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\Æô¶¯Internet Explorer(&H)\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\UWK\\iexplore.exe %1 http://www.dh818.com/?48/"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\Æô¶¯Internet Explorer(&H)	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\Æô¶¯Internet Explorer(&H)\	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\ÊôÐÔ(&R)\Command	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "Internet Explorer"	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\452d375b35e91bf3d59d8538c17aab40_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd4DA4.tmp\System.dll

Filesize
10KB

MD5
810f3a0aefe36a9f63e29e604bea91a9

SHA1
2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

SHA256
f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

SHA512
836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

Download Submit

Analysis

Sharing