a1ccf8f066aa22a586369c6115bec02db59477e25dbc8af362e070cd3ab0afd9

General

Target

fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
Size

91KB
MD5

fc2a11f6b8570fc51b601515a517627f
SHA1

11ecc7097d9097ef2db9d7f6db3c369fff4d7f33
SHA256

a1ccf8f066aa22a586369c6115bec02db59477e25dbc8af362e070cd3ab0afd9
SHA512

2ab93991749045c7920fedc868d8c5d10d08de10cee8da7cc9aebe0db5f91c9391a2b713473e6187f7e7346fb5d33c11ede38f7633025b6076c7abf1bb8a73e8
SSDEEP

1536:q6yvcM7elmDwtS3C6h5Z0arJOBk/Hop+Nc+zb5:q64ckJDTBZjrJOBGo5Gb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	svchos.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	svchos.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchos.exe"	svchos.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svchos.exe

Executes dropped EXE 2 IoCs

pid	Process
2756	svchos.exe
1752	svchos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchos.exe"	svchos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchos.exe"	svchos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 2756 set thread context of 1752	2756	svchos.exe	89

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3144	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
3144	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe
1752	svchos.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 1092 wrote to memory of 3144	1092	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	87
PID 3144 wrote to memory of 2756	3144	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	88
PID 3144 wrote to memory of 2756	3144	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	88
PID 3144 wrote to memory of 2756	3144	fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe	88
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89
PID 2756 wrote to memory of 1752	2756	svchos.exe	89

C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fc2a11f6b8570fc51b601515a517627f_JaffaCakes118.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Users\Admin\AppData\Roaming\svchos.exe
    "C:\Users\Admin\AppData\Roaming\svchos.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Roaming\svchos.exe
      C:\Users\Admin\AppData\Roaming\svchos.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchos.exe

Filesize
91KB

MD5
fc2a11f6b8570fc51b601515a517627f

SHA1
11ecc7097d9097ef2db9d7f6db3c369fff4d7f33

SHA256
a1ccf8f066aa22a586369c6115bec02db59477e25dbc8af362e070cd3ab0afd9

SHA512
2ab93991749045c7920fedc868d8c5d10d08de10cee8da7cc9aebe0db5f91c9391a2b713473e6187f7e7346fb5d33c11ede38f7633025b6076c7abf1bb8a73e8

Download Submit
memory/1092-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1092-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1752-25-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-27-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-37-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-36-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-18-0x00000000004B0000-0x00000000004BB000-memory.dmp

Filesize
44KB

Download
memory/1752-23-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-24-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-35-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-26-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-34-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-28-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-29-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-30-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-31-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-32-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1752-33-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2756-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3144-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3144-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3144-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads