a4ebe8702456763f2331e3beff3cdbc23b2c4087f9b6e00fcea04e6c0bc0b238

General

Target

JaffaCakes118_98213d5695567131c847160bfc05f13e.exe
Size

674KB
MD5

98213d5695567131c847160bfc05f13e
SHA1

8db61294e2c10364533f858047c5bb755327a425
SHA256

a4ebe8702456763f2331e3beff3cdbc23b2c4087f9b6e00fcea04e6c0bc0b238
SHA512

5e79743faa6d870e8936bdf86be17156a3bcb53800d0be2ec844bfeabcbf65d2479c479647a30be67ab99c2961a3df1fbd82c419a8ab9be50d8ecdeb5e54f860
SSDEEP

12288:5NAHr5Vnu0rLysASCvrabYNcvCLBtm+M5vTP2d65sUFX0+sHe5dWvF+pYj/6n7no:C7ParV8a5vHH78JG4/yaOsB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4404	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Start Edition = "/Windows/"	csrss.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\inf\ress\csrss.dll	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe
File created	C:\WINDOWS\inf\ress\open.bat	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1372	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4404	csrss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2400	392	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe	83
PID 392 wrote to memory of 2400	392	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe	83
PID 392 wrote to memory of 2400	392	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe	83
PID 392 wrote to memory of 1372	392	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe	84
PID 392 wrote to memory of 1372	392	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe	84
PID 392 wrote to memory of 1372	392	JaffaCakes118_98213d5695567131c847160bfc05f13e.exe	84
PID 2400 wrote to memory of 4404	2400	cmd.exe	87
PID 2400 wrote to memory of 4404	2400	cmd.exe	87
PID 2400 wrote to memory of 4404	2400	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98213d5695567131c847160bfc05f13e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_98213d5695567131c847160bfc05f13e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\inf\ress\open.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\WINDOWS\inf\ress\csrss.exe
    C:\WINDOWS\inf\ress\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4404
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\inf\ress\csrss.dll

Filesize
206KB

MD5
d505149cb8d11fac41a0beb054bedde4

SHA1
d70b29e8cffcece143069626d0e6b8f614da1591

SHA256
c9452fb2b04a63b395270befc793a6e4a97993d87dfa14d446fd0514b9cc1069

SHA512
1c4471b0be696bcb7b1816f2273ed65db512848ed9866d7380642749db583a8cfc52274421d95ec1042da24b16ed767da2fd766df0e03fb5b5232daeff0d2d51

Download Submit
C:\WINDOWS\inf\ress\open.bat

Filesize
83B

MD5
abde6a7841e0540ed444051a9f86b725

SHA1
1cc6ba90f1670863020f9b179912727e8c697e02

SHA256
4816d36133b30032622d12e069391acb10b4177ee74c9077587c0a93f4e7e3e4

SHA512
e17a5d18154ef36778d833009ca5abc43e0de95c15225231501649e560bfea52d5aa348f99036af400822ff66f341e3f4c60c3362aa41c53c9364ae425a24a96

Download Submit
memory/392-0-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/392-10-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/392-13-0x0000000023840000-0x00000000238EF000-memory.dmp

Filesize
700KB

Download
memory/4404-8-0x0000000000485000-0x0000000000486000-memory.dmp

Filesize
4KB

Download
memory/4404-7-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4404-9-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4404-11-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4404-12-0x0000000000485000-0x0000000000486000-memory.dmp

Filesize
4KB

Download
memory/4404-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads