2e3a7739fd9eb2e6bb2f7747918a025e1bbcd3f8c9fd952d0e4a879992084c9c

General

Target

JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe
Size

496KB
MD5

8aefd589efeb7ceb795ca6cc58f9bf20
SHA1

35bb5e50341d3a72e82e996388c89bbaa9d2efbb
SHA256

2e3a7739fd9eb2e6bb2f7747918a025e1bbcd3f8c9fd952d0e4a879992084c9c
SHA512

d33a443f385345c1659b1e2a2080a9eaf8140117641a03cda7b0ec63ef004ea995fca0fc44b45768ead44ca080f31435aec29a9978c562e061e6ac9d1f03eee0
SSDEEP

12288:FmkbnVZIeNyo1BoGJHKnJFgaXdqu3U8OEtOM2ZNtTird:YqbIeNyos4KnJF1XM8OEtOnTEd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4640	4.exe
1528	Hacker.com.cn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	4.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	4.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.com.cn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	4.exe
Token: SeDebugPrivilege	1528	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1528	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4640	3932	JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe	88
PID 3932 wrote to memory of 4640	3932	JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe	88
PID 3932 wrote to memory of 4640	3932	JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe	88
PID 1300 wrote to memory of 1624	1300	cmd.exe	89
PID 1300 wrote to memory of 1624	1300	cmd.exe	89
PID 1528 wrote to memory of 4772	1528	Hacker.com.cn.exe	94
PID 1528 wrote to memory of 4772	1528	Hacker.com.cn.exe	94

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
  2⤵
  PID:1624

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

Filesize
785KB

MD5
1f4759ec8dc50429ce7127aa292100ae

SHA1
c6583bf92638defbbd915689e5c5782014b0cf7f

SHA256
2da9359008415a0543c02c744b2dadaeb98f5b356755c0bda9e86317df1e40cc

SHA512
3bfcae9241244b655cee125707cbfe13388d4b86bdcc747303b5048d2a19a8f058c3d1192524133048f988553d6c5ae3294f49361f12a535a1b05ecd891298fb

Download Submit
memory/1528-28-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/1528-29-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1528-24-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3932-12-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3932-10-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/3932-11-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/3932-9-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3932-8-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/3932-7-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/3932-6-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3932-5-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3932-4-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/3932-0-0x0000000001000000-0x00000000010E2000-memory.dmp

Filesize
904KB

Download
memory/3932-1-0x00000000005A0000-0x00000000005E3000-memory.dmp

Filesize
268KB

Download
memory/3932-3-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3932-23-0x0000000001000000-0x00000000010E2000-memory.dmp

Filesize
904KB

Download
memory/3932-25-0x00000000005A0000-0x00000000005E3000-memory.dmp

Filesize
268KB

Download
memory/3932-2-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/3932-27-0x0000000001000000-0x00000000010E2000-memory.dmp

Filesize
904KB

Download
memory/4640-26-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4640-18-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads