777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec

General

Target

540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
Size

128KB
MD5

540583f96e62385fd02eb7300062d7be
SHA1

48e628b085d6c22ac4caceeac3e0a2c97d9431c1
SHA256

777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec
SHA512

ee1da166c023b83891f5270e083822889713d45361f22da16948bd07add30c3bb04f08ce1e1078c9e287d4ef01d0d41ca609973912b30c0a3170728faed57922
SSDEEP

1536:/514vVST27uuynw8P9xpdRGf4kVMjE1woL97tmfCk2urv5:h2vVSTayn/P9XupVio4fCklrv5

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "00000000"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "00000000"	csrss.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Script_102236.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	smss.exe

Deletes itself 1 IoCs

pid	Process
1584	csrss.exe

Executes dropped EXE 2 IoCs

pid	Process
2784	smss.exe
1584	csrss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cttmon.exe = "C:\\WINDOWS\\system32\\cttmon.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cttmon.exe = "C:\\WINDOWS\\system32\\cttmon.exe"	csrss.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\R:	smss.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\W:	smss.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\V:	smss.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\O:	smss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\N:	smss.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\f:\autorun.inf	smss.exe
File created	\??\c:\autorun.inf	smss.exe
File opened for modification	\??\c:\autorun.inf	smss.exe
File created	\??\f:\autorun.inf	smss.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\dxdiagupdt.exe	smss.exe
File created	\??\c:\windows\SysWOW64\cttmon.exe	smss.exe
File opened for modification	\??\c:\windows\SysWOW64\cttmon.exe	smss.exe
File created	\??\c:\windows\SysWOW64\dxdiagupdt.exe	smss.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\Script_102236.exe	csrss.exe
File opened for modification	C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Script_102236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Script_102236.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	smss.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1008	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1008	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
1076	Script_102236.exe
2784	smss.exe
2784	smss.exe
1584	csrss.exe
1584	csrss.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1076	1008	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe	85
PID 1008 wrote to memory of 1076	1008	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe	85
PID 1008 wrote to memory of 1076	1008	540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe	85
PID 1076 wrote to memory of 2784	1076	Script_102236.exe	89
PID 1076 wrote to memory of 2784	1076	Script_102236.exe	89
PID 1076 wrote to memory of 2784	1076	Script_102236.exe	89
PID 2784 wrote to memory of 1584	2784	smss.exe	91
PID 2784 wrote to memory of 1584	2784	smss.exe	91
PID 2784 wrote to memory of 1584	2784	smss.exe	91

C:\Users\Admin\AppData\Local\Temp\540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\540583f96e62385fd02eb7300062d7be_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\Script_102236.exe
  "C:\Program Files\Temporary downloads\Active scritps\{89756EC-89913CB-00F1CE}-TIP\Script_102236.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\RECYCLER\S-1-5-21-2847125355-358004884-1566868893-1122\smss.exe
    "C:\RECYCLER\S-1-5-21-2847125355-358004884-1566868893-1122\smss.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\recycler\S-1-5-21-2847125355-358004884-1566868893-1122\csrss.exe
      "C:\recycler\S-1-5-21-2847125355-358004884-1566868893-1122\csrss.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Deletes itself
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\RECYCLER\S-1-5-21-2847125355-358004884-1566868893-1122\smss.exe

Filesize
128KB

MD5
540583f96e62385fd02eb7300062d7be

SHA1
48e628b085d6c22ac4caceeac3e0a2c97d9431c1

SHA256
777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec

SHA512
ee1da166c023b83891f5270e083822889713d45361f22da16948bd07add30c3bb04f08ce1e1078c9e287d4ef01d0d41ca609973912b30c0a3170728faed57922

Download Submit
memory/1008-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads