857a14fcfdff225959a36786d33167e88dc9792e6ff7aec7bf26bd1b6722cb63

General

Target

f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe
Size

2.0MB
MD5

f753bc140ea12b0d52b464d0e50b538b
SHA1

3b25c69aed36377bcc5746d88d0ebf2a3b870023
SHA256

857a14fcfdff225959a36786d33167e88dc9792e6ff7aec7bf26bd1b6722cb63
SHA512

035eac74c02126dca2db8ee4b0b843dfa3c27d71291bd0429918939c9b72d1c300fa164ffda520ed5193c132a0da68e83d8f104be6920400e5f3ae4e25e3fb64
SSDEEP

49152:FEgS1uePl7a5M+fJBCNTieSSrsvluPS3fbf7rKCO682ll:bpePl7+b3CTRs9ucfjvphll

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3472	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe"	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ctfmom.exe	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MEGATROM.ini	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MEGATROM.ini	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ponto.DLL	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
1320	4024	WerFault.exe	82
1352	4024	WerFault.exe	82
4456	4024	WerFault.exe	82
1284	4024	WerFault.exe	82
768	4024	WerFault.exe	82
3456	4024	WerFault.exe	82
4536	4024	WerFault.exe	82
1300	4024	WerFault.exe	82

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\TypedURLs	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4024	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4024	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe
4024	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 3472	4024	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe	85
PID 4024 wrote to memory of 3472	4024	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe	85
PID 4024 wrote to memory of 3472	4024	f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram C:\Users\Admin\AppData\Local\Temp\f753bc140ea12b0d52b464d0e50b538b_JaffaCakes118.exeSz‰†
  2⤵
  - Modifies Windows Firewall
  PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 852
  2⤵
  - Program crash
  PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 864
  2⤵
  - Program crash
  PID:1352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1212
  2⤵
  - Program crash
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1232
  2⤵
  - Program crash
  PID:1284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1256
  2⤵
  - Program crash
  PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1508
  2⤵
  - Program crash
  PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1680
  2⤵
  - Program crash
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1208
  2⤵
  - Program crash
  PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4024 -ip 4024
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4024 -ip 4024
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4024 -ip 4024
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4024 -ip 4024
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4024 -ip 4024
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4024 -ip 4024
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4024 -ip 4024
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4024 -ip 4024
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ponto.DLL

Filesize
399B

MD5
f0161328b321dfcba81d4516524b2781

SHA1
c65bdb62b67f4150f94d75fa64788d8f05b13859

SHA256
f37e10ca84be6e476d1164eca5b1d104f5dac890f02f5de701c61b86f19a1eae

SHA512
273f3bcd6cf80020ac85227184c05d4c901c07e3782e741ee5b8abb63f89171c632725de68f4b015ca902fec4268eaa1101ab8d9b7f592721e08b94a329ff672

Download Submit
memory/4024-0-0x0000000000400000-0x00000000010FA000-memory.dmp

Filesize
13.0MB

Download
memory/4024-1-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/4024-2-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/4024-5-0x0000000000400000-0x00000000010FA000-memory.dmp

Filesize
13.0MB

Download
memory/4024-6-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/4024-10-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads