b9a53039be2a305e3b30e30696d4c8c441ac96dfaf1717c3de9232f8f8abfe6c

General

Target

ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe
Size

434KB
MD5

ccdf968440a23417b86c84ebaae31fb5
SHA1

d77d9600a9932cc1126a007ed1002f47d2aa3715
SHA256

b9a53039be2a305e3b30e30696d4c8c441ac96dfaf1717c3de9232f8f8abfe6c
SHA512

6a747cfc9eaa110d365587ae9ca4daf7dfb4c8cd4f9ae730eb575db474949aa89a84e5d3a5fd82907c4247c67bfc7d468c82ba76d84a2dd8ae3b35fb3bcf1a42
SSDEEP

12288:4LFogcK7y/yfv+uo7yPHYUX848TJiP61wtBoGxNt95a3:4LCdKe/mma3d8TJiP67G195a3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2796	explorer.exe
2124	a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"F:\\msdownld.tmp\\IXP000.TMP\\\""	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe
File opened (read-only)	\??\E:	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe
File opened (read-only)	\??\A:	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2796	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	31
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32
PID 2500 wrote to memory of 2124	2500	ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ccdf968440a23417b86c84ebaae31fb5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- F:\msdownld.tmp\IXP000.TMP\explorer.exe
  F:\msdownld.tmp\IXP000.TMP\explorer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2796
- F:\msdownld.tmp\IXP000.TMP\a.exe
  F:\msdownld.tmp\IXP000.TMP\a.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\msdownld.tmp\IXP000.TMP\a.exe

Filesize
37KB

MD5
5c4253e49a74d2a37e9de8158d792e60

SHA1
5d2555fb1cbc23a15b93a1a8a7d59bec6aee1f64

SHA256
29f95729e262d506a5f411563734264c89f79be8b5ec67bc004d16ac8f2620a3

SHA512
3e490394c4aa47d3efaf734cf23610af186e83956a13b70a09fbd5a39044b147202cb6e60e58e832afe972241e8d2062b4cbd49ab51279c30491325c6fb23420

Download Submit
F:\msdownld.tmp\IXP000.TMP\explorer.exe

Filesize
1009KB

MD5
12896823fb95bfb3dc9b46bcaedc9923

SHA1
9d2bf84874abc5b6e9a2744b7865c193c08d362f

SHA256
1e675cb7df214172f7eb0497f7275556038a0d09c6e5a3e6862c5e26885ef455

SHA512
de5ff5c5bb0fea3f9d08dd1746a6b00501a1e3ca76cfd11adcb8b714c537e1b97abcfa3ad136eb12221b4c503183946c92a583ffb535e302d7aa12c6fe598ed9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads