cybergate | e7c017101889f4560a4762d9d8ec6d52df0fd547cc304789c8ecdfb585a52fac

Modify Registry

Processes:

fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe"	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{57W8XE75-QVS0-3EQK-S03K-8K83IMX8LU7U}	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57W8XE75-QVS0-3EQK-S03K-8K83IMX8LU7U}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe Restart"	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2756-9-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral1/memory/2756-11-0x0000000000400000-0x0000000000459000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe"	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe"	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

pid process

2756 fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

pid	process
2756	fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe322d3f592d0d527909c78b19c9723c_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2756

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry