1fe2341438aea4b0427f3f2808918b6ef00bf742bc903e94022c7f73df914ed4

General

Target

d9fc3b845454f7588b0f48b017fb9a50_JaffaCakes118.exe
Size

1.0MB
MD5

d9fc3b845454f7588b0f48b017fb9a50
SHA1

17de143a193969b85902fa54c1554410dcf72b06
SHA256

1fe2341438aea4b0427f3f2808918b6ef00bf742bc903e94022c7f73df914ed4
SHA512

bb11d7ad5d6f426b23c459d130c8962c66a70fa5d6df35ffbf2bc51ae619dc94bb9bccd990d0856a6a5ca40f0a3d5519b7f0dd075fc9e1a65f846a4a72a7449c
SSDEEP

24576:m2g8AFUAEUM91zfwVPIl6Mw3C1tvIgOB9Af8P2rU:+FUB9wRMUYL8P2rU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
684	kklgdje.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	svchost.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4844	684	WerFault.exe	84
3592	684	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9fc3b845454f7588b0f48b017fb9a50_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kklgdje.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fb297ba4-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fb297ba4-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00660062003200390037006200610034002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00660062003200390037006200610034002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fb297ba4-0000-0000-0000-d01200000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fb297ba4-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fb297ba4-0000-0000-0000-f0ff3a000000}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fb297ba4-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133782268316308769"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133782268320527793"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133782268338964961"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133782268342871569"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133782268344746620"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133782268463183833"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133782268342871569"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133782268464590154"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1536	d9fc3b845454f7588b0f48b017fb9a50_JaffaCakes118.exe
1536	d9fc3b845454f7588b0f48b017fb9a50_JaffaCakes118.exe
684	kklgdje.exe
684	kklgdje.exe
684	kklgdje.exe
684	kklgdje.exe
684	kklgdje.exe
684	kklgdje.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	kklgdje.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe
Token: SeTcbPrivilege	788	svchost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 788	684	kklgdje.exe	8
PID 788 wrote to memory of 2240	788	svchost.exe	95
PID 788 wrote to memory of 2240	788	svchost.exe	95
PID 788 wrote to memory of 2240	788	svchost.exe	95
PID 788 wrote to memory of 2728	788	svchost.exe	98
PID 788 wrote to memory of 2728	788	svchost.exe	98
PID 788 wrote to memory of 2728	788	svchost.exe	98
PID 788 wrote to memory of 4352	788	svchost.exe	100
PID 788 wrote to memory of 4352	788	svchost.exe	100
PID 788 wrote to memory of 4516	788	svchost.exe	102
PID 788 wrote to memory of 4516	788	svchost.exe	102
PID 788 wrote to memory of 4516	788	svchost.exe	102
PID 788 wrote to memory of 4452	788	svchost.exe	104
PID 788 wrote to memory of 4452	788	svchost.exe	104
PID 788 wrote to memory of 4452	788	svchost.exe	104
PID 788 wrote to memory of 4728	788	svchost.exe	105
PID 788 wrote to memory of 4728	788	svchost.exe	105
PID 788 wrote to memory of 3140	788	svchost.exe	106
PID 788 wrote to memory of 3140	788	svchost.exe	106

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2240
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2728
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:4352
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4516
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4452
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:4728
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:3140

C:\Users\Admin\AppData\Local\Temp\d9fc3b845454f7588b0f48b017fb9a50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d9fc3b845454f7588b0f48b017fb9a50_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Users\Admin\AppData\Local\Temp\kklgdje.exe
C:\Users\Admin\AppData\Local\Temp\kklgdje.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 712
  2⤵
  - Program crash
  PID:4844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 720
  2⤵
  - Program crash
  PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 684 -ip 684
1⤵
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 684 -ip 684
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\bwxpxog

Filesize
654B

MD5
3f89a6a9e526b04f947c2b88ef3f778c

SHA1
8255cd8eef6a75e020e581fa434cc8af8939f764

SHA256
65837c133452b53004c8859dfde9327f3da322828490efd72f00361caae761a5

SHA512
4ff746af8f4953545a4720f30701d0fbfd9599e12a7b53f92c1186b72536146fc73aa9be5cdcb1ebb876c1153cd7a78048dd315153af7599cda2642ab6a5d466

Download Submit
C:\Users\Admin\AppData\Local\Temp\kklgdje.exe

Filesize
1.0MB

MD5
d9fc3b845454f7588b0f48b017fb9a50

SHA1
17de143a193969b85902fa54c1554410dcf72b06

SHA256
1fe2341438aea4b0427f3f2808918b6ef00bf742bc903e94022c7f73df914ed4

SHA512
bb11d7ad5d6f426b23c459d130c8962c66a70fa5d6df35ffbf2bc51ae619dc94bb9bccd990d0856a6a5ca40f0a3d5519b7f0dd075fc9e1a65f846a4a72a7449c

Download Submit
memory/684-18-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/684-21-0x0000000003010000-0x000000000325B000-memory.dmp

Filesize
2.3MB

Download
memory/788-30-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-46-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-235-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-32-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-27-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-26-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-24-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-237-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/788-3399-0x000000000B3C0000-0x000000000B437000-memory.dmp

Filesize
476KB

Download
memory/1536-6-0x0000000004580000-0x00000000045D5000-memory.dmp

Filesize
340KB

Download
memory/1536-13-0x0000000004A00000-0x0000000004C4B000-memory.dmp

Filesize
2.3MB

Download
memory/1536-10-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/1536-12-0x00000000047E0000-0x00000000049FA000-memory.dmp

Filesize
2.1MB

Download
memory/1536-9-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-8-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-7-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-0-0x0000000004580000-0x00000000045D5000-memory.dmp

Filesize
340KB

Download
memory/1536-5-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-4-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-3-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-2-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1536-1-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing