9f2238381a864db192fb8b902a11e8c1d7170b2ab03aae723952e03518dda34a

General

Target

03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
Size

1.2MB
MD5

03c281d0c79898ba5e0c472c0093cb4d
SHA1

e3313bf5c501460615885d1a51ea7bc7a5b14851
SHA256

9f2238381a864db192fb8b902a11e8c1d7170b2ab03aae723952e03518dda34a
SHA512

7e642e1541293ed0888d72ff7819590fa85106939c66ea4b048682b636e596baf1e858d722697d1f6ecb090bcf34ff25e88c8e4e8bca92f217a7d816aeefd903
SSDEEP

24576:91bRfdYmRwmOcwLMIorvUhK9BoDyzPBP7qT4PQKL+0fCjovvbOjrdX3:9bfGmRwNcodor8h2yDgBP7ZlL+0QrdX3

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\dotnet.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXC83E.tmp	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\createdump.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\mip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXC81D.tmp	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\LICLUA.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSE.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\dotnet.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c281d0c79898ba5e0c472c0093cb4d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:4280

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DC++ Share\java-rmi.exe
Filesize
108KB

MD5
9e3965c87aa864c1eff185b4d06f87ed

SHA1
f4061d73356035f56e56bb2df075ece5b26de531

SHA256
6426031df9a29d70a830c717a71ba7d3d7e7b30da6ad2b1e00a1831689b61f3b

SHA512
e54ad04f89008bb22543ac72c31af39c56c4263a3199248033b7d039fe92739969e8119dcc44b5405896bc1581d2ca7b0e83b3ef8c809289146731d6ee77cc1a

Download Submit
C:\Windows\SysWOW64\xdccPrograms\7zG.exe
Filesize
1.2MB

MD5
03c281d0c79898ba5e0c472c0093cb4d

SHA1
e3313bf5c501460615885d1a51ea7bc7a5b14851

SHA256
9f2238381a864db192fb8b902a11e8c1d7170b2ab03aae723952e03518dda34a

SHA512
7e642e1541293ed0888d72ff7819590fa85106939c66ea4b048682b636e596baf1e858d722697d1f6ecb090bcf34ff25e88c8e4e8bca92f217a7d816aeefd903

Download Submit
memory/4280-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-29-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-22-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-23-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-24-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-21-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-104-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-105-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-106-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-107-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4280-108-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads