950dec4a5f8dfaa53ada29e64f3b04d5df9760b576a6dccdefc59dcc00f17845

General

Target

fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Size

62KB
MD5

fd62559cf6154fc62379674ab1448ff9
SHA1

0f8d07dc1947a8b65adb47c107be9bac8b4a2ff9
SHA256

950dec4a5f8dfaa53ada29e64f3b04d5df9760b576a6dccdefc59dcc00f17845
SHA512

fb74bfd41ec953e395fc9b342ffe2f53f1f207e8c4b72c1ccc0512834b220d5b9e13d0edeb46d5aa824de19ef0ee85754d32d927c7b055b838f5cc6d90f9ce59
SSDEEP

1536:xujsHnCW6tJ++UEdnD9Ryp4tHuEQdhLK+UtxZyWKXdF9l:xuYHCWO4+tD9vFydw+UtjuF3

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 2 IoCs

pid	Process
1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
1456	RunDll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Windows Share = "RunDll32 \"C:\\Windows\\system32\\perfperf.dll\",Init"	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\perfperf.dll	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\perfperf.dll	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\lsaupup.dll	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\lsaupup.dll	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\logsvcet.dll	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
File opened for modification	C:\Windows\Offline Web Pages\logsvcet.dll	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1104	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	19
PID 1284 wrote to memory of 1104	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	19
PID 1284 wrote to memory of 1184	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	20
PID 1284 wrote to memory of 1184	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	20
PID 1284 wrote to memory of 1208	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	21
PID 1284 wrote to memory of 1208	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	21
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28
PID 1284 wrote to memory of 1456	1284	fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe	28

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fd62559cf6154fc62379674ab1448ff9_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32 "C:\Users\Admin\AppData\Local\Temp\900F.tmp",Init
    3⤵
    - Loads dropped DLL
    PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\900F.tmp

Filesize
60KB

MD5
9662adab522f3a6a0c737fde70eacdd7

SHA1
79cf90f9075c888f73f058faeb68cfbad692bb5d

SHA256
7be75dd3354ec9531442e6912e6da41a03549a6e3c1f69698904ae9a590ef387

SHA512
da68e512aa4f24e3bc4591d557ca9418800d54d1071e41e860811bd0fcacce3b229875f6bd75a7426ed85f73eaba2e9c0e111285feae2c2966e10b510f6d52f5

Download Submit
memory/1104-16-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1104-17-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1284-4-0x0000000074E50000-0x0000000074E73000-memory.dmp

Filesize
140KB

Download
memory/1284-5-0x0000000074E50000-0x0000000074E73000-memory.dmp

Filesize
140KB

Download
memory/1284-33-0x0000000074E50000-0x0000000074E73000-memory.dmp

Filesize
140KB

Download
memory/1456-21-0x0000000074E50000-0x0000000074E73000-memory.dmp

Filesize
140KB

Download
memory/1456-31-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1456-32-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1456-34-0x0000000074E50000-0x0000000074E73000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads