cd7a8a5466063a87fdde87245e739d40b49b440fdf35f0fa0f1412b56d111708

General

Target

JaffaCakes118_b2f5e216e843f5bbdd494772d0facf20.exe
Size

173KB
MD5

b2f5e216e843f5bbdd494772d0facf20
SHA1

3001c34612161dd810bc5324e3f5453fa1aaa90d
SHA256

cd7a8a5466063a87fdde87245e739d40b49b440fdf35f0fa0f1412b56d111708
SHA512

15122ae9b3b0a8268165f6c60fd035063e52a4a523a6b15b4d4419204aa1f9f9b76d942dd2f18d4f2213f6461fb727a1f8b0e95333dc8ffa3be8ed38a91bf218
SSDEEP

3072:J42TEAhxd+TYYKt4OOySbJ7MkBfOrQ765ViYwpb0wy2B93fsxeJaLSDwM1YAfD:J44EGnuYYKt4xTMcHA8posVfsxeJzhL

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	JaffaCakes118_b2f5e216e843f5bbdd494772d0facf20.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b2f5e216e843f5bbdd494772d0facf20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc8be0b564d67345b0cfc025d45f55ed0000000002000000000010660000000100002000000017d5d87ea618add49423a98570c4cc4eba34e74b631248e4af8e29fa9fbd9e24000000000e80000000020000200000008e63b8479b134392ef27da3d78046d7ddfd9973233f6b61855b0167e467010e520000000f1c0ac7f980c063b0397110e611001b58e20be756eb5a3f51276b6909e3e4a714000000016c58cc174697006316da38e89aae08a448dc312f6da6a3f1634855d33ec50176dbbcdafecc800075fc397f2cda852b20732094efdf25e5b20fffeb99bd6a336	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{59B3DD35-17F9-11F0-86E9-46172D3D8C37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6032dd3206acdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc8be0b564d67345b0cfc025d45f55ed000000000200000000001066000000010000200000007368481fa84915aa31357d52c58791e253cd4250e61adfdbe3cc0d86a0d2cc03000000000e8000000002000020000000b5047d2bf63fefc479ceed1f974b33e61f1f36ff7a767d91e7f9140123de5111200000001afd24024db0cb7b113d582de6a2693aa9d696329f7f2622d0b909f3a88d90a6400000000caf851949404785959e7e61765f36c1d98a269e83968f5a1afbeb5805fd20dfa865174c1b2ae5535bbe7b6bf760b0650f7fae7feb5a2765b141cf2d6072073c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cfe63206acdb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4452	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4452	iexplore.exe
4452	iexplore.exe
5612	IEXPLORE.EXE
5612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 5612	4452	iexplore.exe	100
PID 4452 wrote to memory of 5612	4452	iexplore.exe	100
PID 4452 wrote to memory of 5612	4452	iexplore.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2f5e216e843f5bbdd494772d0facf20.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2f5e216e843f5bbdd494772d0facf20.exe"
1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
PID:312

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5428

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4452 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5612