2a2810ff068467030f05624230fc590ac4e3ef2c9df76a4fe6d1feedf06f8344

General

Target

fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe
Size

432KB
MD5

fbdda05780c0105abdd755fec2900580
SHA1

e463f3e0ddfcf8f340905027b596966e973f546a
SHA256

2a2810ff068467030f05624230fc590ac4e3ef2c9df76a4fe6d1feedf06f8344
SHA512

8440c10fdf797bfb757fd3deed51f48534eb7367d7bf76ac51dd6fc2c7be04292d831bd0d1c084d0abbea3ad75c26b7818e64db3b5d26f28ce5c7e133302eb99
SSDEEP

6144:BO+WwBZthD5J+x9dmKcMVqUl6c4jKMNvyX93dFoMrdUZnD698gWNlPTGQQm6agrG:tvZ/5J+Y1IlErvyX93dr+DVNtTird0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

SERVER~1.EXEHacker.com.cn.exe

pid process

4072 SERVER~1.EXE
4796 Hacker.com.cn.exe

pid	process
4072	SERVER~1.EXE
4796	Hacker.com.cn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

SERVER~1.EXE

description	ioc	process
File created	C:\Windows\Hacker.com.cn.exe	SERVER~1.EXE
File opened for modification	C:\Windows\Hacker.com.cn.exe	SERVER~1.EXE
File created	C:\Windows\uninstal.bat	SERVER~1.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SERVER~1.EXEHacker.com.cn.exe

description pid process

Token: SeDebugPrivilege 4072 SERVER~1.EXE
Token: SeDebugPrivilege 4796 Hacker.com.cn.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Hacker.com.cn.exe

pid process

4796 Hacker.com.cn.exe

description	pid	process
Token: SeDebugPrivilege	4072	SERVER~1.EXE
Token: SeDebugPrivilege	4796	Hacker.com.cn.exe

pid	process
4796	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fbdda05780c0105abdd755fec2900580_JaffaCakes118.exeSERVER~1.EXEHacker.com.cn.exe

description	pid	process	target process
PID 4256 wrote to memory of 4072	4256	fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe	SERVER~1.EXE
PID 4256 wrote to memory of 4072	4256	fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe	SERVER~1.EXE
PID 4256 wrote to memory of 4072	4256	fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe	SERVER~1.EXE
PID 4072 wrote to memory of 4860	4072	SERVER~1.EXE	cmd.exe
PID 4072 wrote to memory of 4860	4072	SERVER~1.EXE	cmd.exe
PID 4072 wrote to memory of 4860	4072	SERVER~1.EXE	cmd.exe
PID 4796 wrote to memory of 1256	4796	Hacker.com.cn.exe	IEXPLORE.EXE
PID 4796 wrote to memory of 1256	4796	Hacker.com.cn.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbdda05780c0105abdd755fec2900580_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4256

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
3⤵
PID:4860

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4796

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
2⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
Filesize
272KB

MD5
97a5843eca20dbb324357b65791cffe5

SHA1
1b6467c511749ae2256c805644f1bf8abbdd617d

SHA256
d325ebc2af7e77e8191b7348a21da434f19904010792d265a9cb3b3a6cb03733

SHA512
b788a9a0ee8c9b13f5f0df67d1f83eee3bf45cfd5ff6867abeed6d2f7234857f4c8c0aedad131f6097f76e2e6b66fa6455ff87477379be0e87daea41db0cc7cd

Download Submit
C:\Windows\uninstal.bat
Filesize
164B

MD5
924ea7ae6df752587469376459875c51

SHA1
ec5fa69c7e5dcaf5b57eefadc4f25a8e4ae073e1

SHA256
46c715ac82d5774479b760757498ddb0b9f75cebc116a3da81f9e438bc9bbb09

SHA512
ea7b176a411b82faf5fcd785c67180f88f9ff28f7e24c4f4b49f8e7cdc99fb60e38722b61547a4291bdd2c56b3729045c2e8d4afbecfe03612ab0dd8a7b6ae35

Download Submit
memory/4072-51-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4072-40-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4072-37-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4072-38-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4072-36-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4256-9-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/4256-5-0x0000000000B30000-0x0000000000B32000-memory.dmp

Filesize
8KB

Download
memory/4256-25-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/4256-24-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/4256-23-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4256-22-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/4256-21-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/4256-20-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/4256-19-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/4256-18-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/4256-17-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/4256-16-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4256-14-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/4256-13-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/4256-11-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/4256-12-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/4256-10-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/4256-0-0x0000000001000000-0x0000000001077000-memory.dmp

Filesize
476KB

Download
memory/4256-8-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/4256-7-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/4256-6-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/4256-26-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4256-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4256-4-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/4256-27-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/4256-28-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/4256-29-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4256-30-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4256-15-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/4256-39-0x0000000001000000-0x0000000001077000-memory.dmp

Filesize
476KB

Download
memory/4256-52-0x0000000001000000-0x0000000001077000-memory.dmp

Filesize
476KB

Download
memory/4256-45-0x0000000000A50000-0x0000000000A93000-memory.dmp

Filesize
268KB

Download
memory/4256-53-0x0000000000A50000-0x0000000000A93000-memory.dmp

Filesize
268KB

Download
memory/4256-2-0x0000000000A50000-0x0000000000A93000-memory.dmp

Filesize
268KB

Download
memory/4256-1-0x0000000001000000-0x0000000001077000-memory.dmp

Filesize
476KB

Download
memory/4796-47-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4796-49-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/4796-46-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4796-55-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4796-56-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4796-57-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads