a1ccf8f066aa22a586369c6115bec02db59477e25dbc8af362e070cd3ab0afd9

General

Target

fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
Size

91KB
MD5

fc2a11f6b8570fc51b601515a517627f
SHA1

11ecc7097d9097ef2db9d7f6db3c369fff4d7f33
SHA256

a1ccf8f066aa22a586369c6115bec02db59477e25dbc8af362e070cd3ab0afd9
SHA512

2ab93991749045c7920fedc868d8c5d10d08de10cee8da7cc9aebe0db5f91c9391a2b713473e6187f7e7346fb5d33c11ede38f7633025b6076c7abf1bb8a73e8
SSDEEP

1536:q6yvcM7elmDwtS3C6h5Z0arJOBk/Hop+Nc+zb5:q64ckJDTBZjrJOBGo5Gb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svchos.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchos.exe"	svchos.exe

Executes dropped EXE 2 IoCs

pid	Process
836	svchos.exe
2652	svchos.exe

Loads dropped DLL 2 IoCs

pid	Process
1612	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
836	svchos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchos.exe"	svchos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchos.exe"	svchos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 836 set thread context of 2652	836	svchos.exe	30

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1612	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
2652	svchos.exe
2652	svchos.exe
2652	svchos.exe
2652	svchos.exe
2652	svchos.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 2196 wrote to memory of 1612	2196	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	28
PID 1612 wrote to memory of 836	1612	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	29
PID 1612 wrote to memory of 836	1612	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	29
PID 1612 wrote to memory of 836	1612	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	29
PID 1612 wrote to memory of 836	1612	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	29
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30
PID 836 wrote to memory of 2652	836	svchos.exe	30

C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Users\Admin\AppData\Roaming\svchos.exe
    "C:\Users\Admin\AppData\Roaming\svchos.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Users\Admin\AppData\Roaming\svchos.exe
      C:\Users\Admin\AppData\Roaming\svchos.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchos.exe

Filesize
91KB

MD5
fc2a11f6b8570fc51b601515a517627f

SHA1
11ecc7097d9097ef2db9d7f6db3c369fff4d7f33

SHA256
a1ccf8f066aa22a586369c6115bec02db59477e25dbc8af362e070cd3ab0afd9

SHA512
2ab93991749045c7920fedc868d8c5d10d08de10cee8da7cc9aebe0db5f91c9391a2b713473e6187f7e7346fb5d33c11ede38f7633025b6076c7abf1bb8a73e8

Download Submit
memory/836-40-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/836-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1612-11-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-15-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-22-0x0000000000230000-0x000000000024B000-memory.dmp

Filesize
108KB

Download
memory/1612-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2196-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2652-45-0x00000000002C0000-0x00000000002CB000-memory.dmp

Filesize
44KB

Download
memory/2652-50-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-51-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-52-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-53-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-54-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-58-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-59-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-60-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-61-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-62-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-63-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-64-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads