9f2238381a864db192fb8b902a11e8c1d7170b2ab03aae723952e03518dda34a

General

Target

03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
Size

1.2MB
MD5

03c281d0c79898ba5e0c472c0093cb4d
SHA1

e3313bf5c501460615885d1a51ea7bc7a5b14851
SHA256

9f2238381a864db192fb8b902a11e8c1d7170b2ab03aae723952e03518dda34a
SHA512

7e642e1541293ed0888d72ff7819590fa85106939c66ea4b048682b636e596baf1e858d722697d1f6ecb090bcf34ff25e88c8e4e8bca92f217a7d816aeefd903
SSDEEP

24576:91bRfdYmRwmOcwLMIorvUhK9BoDyzPBP7qT4PQKL+0fCjovvbOjrdX3:9bfGmRwNcodor8h2yDgBP7ZlL+0QrdX3

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaws.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaw.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\apt.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javah.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javaw.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javap.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\mip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\apt.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\mip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javap.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2220

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zG.exe
Filesize
1.2MB

MD5
b80004cb427b391ace7eb057847d0246

SHA1
54eb8b2ed71c7236b0322672bb6b86b0a2ba149c

SHA256
5338e345392074b1374dd6c21fa7f2f183b9d71ecf072c94d0d758a6cbcd901a

SHA512
831376d47309f05e03a7229b2f6d469a65c72475bfbf4ca1d68517aad51531f1d79e2bc3110dc70ac4fc52cb7c89f4bb44a7f7574ddfadd2c46819cd90fcbd9a

Download Submit
memory/2220-86-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-87-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-88-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-89-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-90-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-91-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-92-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-93-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-94-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-95-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-96-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-97-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-98-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-99-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads