d646ecf9a3129198c6b1d832518fce34e093851c21e32c99353779c428da3833

General

Target

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe
Size

129KB
MD5

fe90d5dfa60dad355df93bd04bf6fa50
SHA1

c52a3f8818598932bb70916d7b9af3f10e2f2e08
SHA256

d646ecf9a3129198c6b1d832518fce34e093851c21e32c99353779c428da3833
SHA512

e635d45bb07311fcce15f60c7fdb77478b1cdf4af500d73379d2430a8a06d07432cb23b651bff5527a2b0abffe9046f2d67a726f841be99be36566bbd65aa5bf
SSDEEP

1536:dgb+dHlIFvviUq2VXtxOowiVdIyk4Xys4GTNKan4bFpb251VrGrT86Swnmio3+j4:BdSBv1xRIyk/ANK8IJ86QxoI/

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 7 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe:*:Enabled:Java Updater"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe

Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

2700 explorer.exe
Loads dropped DLL 2 IoCs

Processes:

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

pid process

2188 fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe
2188 fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

pid	process
2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe
2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Java Updater = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe"	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2608 reg.exe
2540 reg.exe

pid	process
2608	reg.exe
2540	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exe

pid	process
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe
2700	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2700 explorer.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 2700 explorer.exe

description	pid	process
Token: SeDebugPrivilege	2700	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2188 wrote to memory of 2508	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2508	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2508	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2508	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2100	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2100	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2100	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2100	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2556	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2556	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2556	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2188 wrote to memory of 2556	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	cmd.exe
PID 2508 wrote to memory of 2632	2508	cmd.exe	reg.exe
PID 2508 wrote to memory of 2632	2508	cmd.exe	reg.exe
PID 2508 wrote to memory of 2632	2508	cmd.exe	reg.exe
PID 2508 wrote to memory of 2632	2508	cmd.exe	reg.exe
PID 2100 wrote to memory of 2608	2100	cmd.exe	reg.exe
PID 2100 wrote to memory of 2608	2100	cmd.exe	reg.exe
PID 2100 wrote to memory of 2608	2100	cmd.exe	reg.exe
PID 2100 wrote to memory of 2608	2100	cmd.exe	reg.exe
PID 2556 wrote to memory of 2540	2556	cmd.exe	reg.exe
PID 2556 wrote to memory of 2540	2556	cmd.exe	reg.exe
PID 2556 wrote to memory of 2540	2556	cmd.exe	reg.exe
PID 2556 wrote to memory of 2540	2556	cmd.exe	reg.exe
PID 2188 wrote to memory of 2700	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe
PID 2188 wrote to memory of 2700	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe
PID 2188 wrote to memory of 2700	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe
PID 2188 wrote to memory of 2700	2188	fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe90d5dfa60dad355df93bd04bf6fa50_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v "FirewallDisableNotify" /t REG_DWORD /d "1" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v "FirewallDisableNotify" /t REG_DWORD /d "1" /f
3⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2608

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Java Updater" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Java Updater" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2540

C:\Users\Admin\AppData\Roaming\explorer.exe
"C:\Users\Admin\AppData\Roaming\explorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\explorer.exe
Filesize
129KB

MD5
fe90d5dfa60dad355df93bd04bf6fa50

SHA1
c52a3f8818598932bb70916d7b9af3f10e2f2e08

SHA256
d646ecf9a3129198c6b1d832518fce34e093851c21e32c99353779c428da3833

SHA512
e635d45bb07311fcce15f60c7fdb77478b1cdf4af500d73379d2430a8a06d07432cb23b651bff5527a2b0abffe9046f2d67a726f841be99be36566bbd65aa5bf

Download Submit
memory/2188-0-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2188-1-0x0000000001E90000-0x0000000001ED0000-memory.dmp

Filesize
256KB

Download
memory/2188-2-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2188-15-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-16-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-18-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2700-17-0x00000000020F0000-0x0000000002130000-memory.dmp

Filesize
256KB

Download
memory/2700-19-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads