f31c7bbf84e4dcec5219329d4eb6e6247dbff11de2f9eaf15f0566661a72a697

General

Target

eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe
Size

81KB
MD5

eb03ddb64b8395967daa13c65b1f0a99
SHA1

5f7fbe7f2581653238e0e9e7241f1e48896c04a6
SHA256

f31c7bbf84e4dcec5219329d4eb6e6247dbff11de2f9eaf15f0566661a72a697
SHA512

2456c884a5b6c45643efb4c8142547994879c335b2a02a33aaa56bf1514c761d50f7e295f804609f7868d3a119d9b0291aa05bc701c88f31366068c6e3acc579
SSDEEP

1536:Xd42bqnA9raIhtfHwZFqWMzDV+ewZHYYpcVztJLR0oOHpo9tKTteT:XDbCA9raIhNwZFq5AVBpcVztJLRpOJoj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
884	rotr.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3320-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/files/0x000800000002333f-4.dat	upx
behavioral2/memory/3320-6-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-7-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-8-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-9-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-10-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-11-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-12-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-13-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-14-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-15-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-16-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-17-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-18-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-19-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/884-20-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ieuu = "C:\\Program Files (x86)\\unue\\rotr.exe"	eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ieuu = "C:\\Program Files (x86)\\unue\\rotr.exe"	rotr.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\unue\rotr.exe	eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe
File created	C:\Program Files (x86)\unue\rotr.exe	eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\unue\rotr.exe	rotr.exe
File created	C:\Program Files (x86)\unue\rotr.exe	rotr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 884	3320	eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe	95
PID 3320 wrote to memory of 884	3320	eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe	95
PID 3320 wrote to memory of 884	3320	eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb03ddb64b8395967daa13c65b1f0a99_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\unue\rotr.exe
  "C:\Program Files (x86)\unue\rotr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\unue\rotr.exe

Filesize
81KB

MD5
eb03ddb64b8395967daa13c65b1f0a99

SHA1
5f7fbe7f2581653238e0e9e7241f1e48896c04a6

SHA256
f31c7bbf84e4dcec5219329d4eb6e6247dbff11de2f9eaf15f0566661a72a697

SHA512
2456c884a5b6c45643efb4c8142547994879c335b2a02a33aaa56bf1514c761d50f7e295f804609f7868d3a119d9b0291aa05bc701c88f31366068c6e3acc579

Download Submit
memory/884-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-14-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-10-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-20-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-19-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-17-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/884-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3320-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3320-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads