acde40ab1f800c9c616a5a9cdba72abe83f23a5032d88c61daa175917385a52c

General

Target

f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
Size

254KB
MD5

f5dd565288e19c6125f15ed05a46f43f
SHA1

cbe2bbfda79c4e71d5236e80d0cc62b19e420c46
SHA256

acde40ab1f800c9c616a5a9cdba72abe83f23a5032d88c61daa175917385a52c
SHA512

7a02ef19a209dd28b28bb2555e079fc55051566116ba0b84b22f64ede8137d4b876b9b8b0113ac9979e3dd7f07ded826a6467a79ceee7b3950dc865a166567b5
SSDEEP

6144:KXpzivISeim9jmoD/EwY6V4WndGHtlraFUuv/wbvH43pNbEMw7:EpzUISefhrb5E6FUuwb/43pKM

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\a3ebad21\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
2112	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
336	csrss.exe
2524	X

Loads dropped DLL 2 IoCs

pid	Process
1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 2112	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	29

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}\u = "71"	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}\cid = "13247620583256424260"	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
2524	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
Token: SeDebugPrivilege	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1152	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	20
PID 1636 wrote to memory of 336	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	2
PID 1636 wrote to memory of 2524	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2524	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2524	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2524	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	28
PID 2524 wrote to memory of 1152	2524	X	20
PID 1636 wrote to memory of 2112	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2112	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2112	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2112	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	29
PID 1636 wrote to memory of 2112	1636	f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe	29
PID 336 wrote to memory of 2556	336	csrss.exe	31
PID 336 wrote to memory of 2556	336	csrss.exe	31
PID 336 wrote to memory of 2788	336	csrss.exe	32
PID 336 wrote to memory of 2788	336	csrss.exe	32

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1152
- C:\Users\Admin\AppData\Local\Temp\f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5dd565288e19c6125f15ed05a46f43f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\a3ebad21\X
    *0*47*4826ff44*69.64.52.10:53
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2112

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2556

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\AppData\Local\a3ebad21\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
10f1005585e6c66ac3aa7ed5599bbf99

SHA1
275e7ba43edd710c72453c70520f5881da9c1208

SHA256
d0b694bc46b97b6b4f9610c8450063b28caba33fe05b0918a8be0a9c17c7fd4e

SHA512
49390ae60e4cfb5a694080693b0923cbbb736d5d1b7f8ab937950f021a7947b7f8604e8d5e999b2c0eab3b44e597f67b41dcf99c29c75eb399c287c4f279acb9

Download Submit
memory/336-40-0x0000000002A10000-0x0000000002A12000-memory.dmp

Filesize
8KB

Download
memory/336-20-0x0000000002280000-0x000000000228B000-memory.dmp

Filesize
44KB

Download
memory/336-19-0x0000000002280000-0x000000000228B000-memory.dmp

Filesize
44KB

Download
memory/1152-29-0x0000000002A20000-0x0000000002A28000-memory.dmp

Filesize
32KB

Download
memory/1152-11-0x0000000002A20000-0x0000000002A26000-memory.dmp

Filesize
24KB

Download
memory/1152-3-0x0000000002A20000-0x0000000002A26000-memory.dmp

Filesize
24KB

Download
memory/1152-7-0x0000000002A20000-0x0000000002A26000-memory.dmp

Filesize
24KB

Download
memory/1152-12-0x0000000002A10000-0x0000000002A12000-memory.dmp

Filesize
8KB

Download
memory/1152-27-0x0000000002AA0000-0x0000000002AAB000-memory.dmp

Filesize
44KB

Download
memory/1152-32-0x0000000002AA0000-0x0000000002AAB000-memory.dmp

Filesize
44KB

Download
memory/1152-36-0x0000000002AA0000-0x0000000002AAB000-memory.dmp

Filesize
44KB

Download
memory/1152-37-0x0000000002E30000-0x0000000002E3B000-memory.dmp

Filesize
44KB

Download
memory/1152-42-0x0000000002E30000-0x0000000002E3B000-memory.dmp

Filesize
44KB

Download
memory/1636-2-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/1636-39-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/1636-41-0x0000000030670000-0x00000000306C4000-memory.dmp

Filesize
336KB

Download
memory/1636-38-0x0000000030670000-0x00000000306C4000-memory.dmp

Filesize
336KB

Download
memory/1636-1-0x0000000030670000-0x00000000306C4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads