38a8bbe565c498faa53bc4005378cf28120e1b13b8154d91e12650c7f5e41d52

General

Target

f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
Size

366KB
MD5

f052c22a54c49c53abf1936adc05eace
SHA1

d95e7b6243392308d3cd2631636a675731fcf613
SHA256

38a8bbe565c498faa53bc4005378cf28120e1b13b8154d91e12650c7f5e41d52
SHA512

e380442f07eebf9f4c291fff3d4a683c3187cf7a3a478f7dcf8d923c623a3d0b8501b04cc90dc4bf25114f851749037b258fa94259cbf469b398288db9971be0
SSDEEP

6144:IgXJ2G2EAXdHVk/sa51lO7g7UL4mlu1F7AS+cvddUfiHVi:GG2EAXdHVUsaRO7gxmluj/dhHV

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnet = "C:\\dropped.exe"	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll.exe"	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2184 set thread context of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2712	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2712	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2712	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2712	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	28
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2568	2184	f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  f052c22a54c49c53abf1936adc05eace_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/2184-1-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/2184-2-0x0000000000A60000-0x0000000000AA0000-memory.dmp

Filesize
256KB

Download
memory/2184-24-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/2568-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2568-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads