843b55842d31579dc888510e7086cc2683ac607374c8348fd14ec644450ef92e

General

Target

fce5eed236dbd60dd90174b70a60e295_JaffaCakes118.exe
Size

22KB
MD5

fce5eed236dbd60dd90174b70a60e295
SHA1

f2518de0056571764e155ca14f6bee1a83bf90ec
SHA256

843b55842d31579dc888510e7086cc2683ac607374c8348fd14ec644450ef92e
SHA512

c597b8d48f4cab453d6603ef0b1815b59ecd7831a92ce3b49b26420508283c2cfcdf34c779207f44ee802a4f7be09681e531c1e3b1a98f7cab20efec721941af
SSDEEP

384:y4KHtv9kM52D/EHRNqYHIAC6+bexlaWDgcjQIa91To7cc3jIf:oKjExqQd9jNa/o7/3jIf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2220	msztbukv.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msztbukv.exe	fce5eed236dbd60dd90174b70a60e295_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	msztbukv.exe
File created	C:\Windows\SysWOW64\msztbukv.exe	fce5eed236dbd60dd90174b70a60e295_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	msztbukv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	msztbukv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84BC0F95-EC04-4C97-A03E-F0C9BB207BD5}\WpadDecisionTime = d0416d562993da01	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84BC0F95-EC04-4C97-A03E-F0C9BB207BD5}\WpadDecision = "0"	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84BC0F95-EC04-4C97-A03E-F0C9BB207BD5}\9a-09-90-c1-9a-0f	msztbukv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84BC0F95-EC04-4C97-A03E-F0C9BB207BD5}	msztbukv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84BC0F95-EC04-4C97-A03E-F0C9BB207BD5}\WpadNetworkName = "Network 3"	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-09-90-c1-9a-0f\WpadDecisionReason = "1"	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-09-90-c1-9a-0f\WpadDecision = "0"	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	msztbukv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-09-90-c1-9a-0f\WpadDecisionTime = d0416d562993da01	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	msztbukv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msztbukv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0115000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84BC0F95-EC04-4C97-A03E-F0C9BB207BD5}\WpadDecisionReason = "1"	msztbukv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-09-90-c1-9a-0f	msztbukv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	msztbukv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	msztbukv.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2220	msztbukv.exe

C:\Users\Admin\AppData\Local\Temp\fce5eed236dbd60dd90174b70a60e295_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fce5eed236dbd60dd90174b70a60e295_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
PID:2184

C:\Windows\SysWOW64\msztbukv.exe
C:\Windows\SysWOW64\msztbukv.exe /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msztbukv.exe

Filesize
22KB

MD5
fce5eed236dbd60dd90174b70a60e295

SHA1
f2518de0056571764e155ca14f6bee1a83bf90ec

SHA256
843b55842d31579dc888510e7086cc2683ac607374c8348fd14ec644450ef92e

SHA512
c597b8d48f4cab453d6603ef0b1815b59ecd7831a92ce3b49b26420508283c2cfcdf34c779207f44ee802a4f7be09681e531c1e3b1a98f7cab20efec721941af

Download Submit
memory/2184-0-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/2220-3-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads