cf16918c193ebc576bc8070e1fe5c16ae595b6dd23130ad47f7f66cfd13f5a45

General

Target

042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
Size

913KB
MD5

042f5809f529b9d06119953c1d3a2bbd
SHA1

e9545c97b3a28df2d2d19c57b9bf60abf3087d4a
SHA256

cf16918c193ebc576bc8070e1fe5c16ae595b6dd23130ad47f7f66cfd13f5a45
SHA512

ea20d68a736981578a365374019234d28105e8d0ad5f3f863ed16237e5d86762bc8267d7e99a12d1cb65c61ef74c84de82cde7a0b6b35f86e6774699f0f8cf9c
SSDEEP

24576:30Qi1ZDezSQzIGCOKb3Aih50eaQU5mHIRsUTSejHzPoeeMc34p8345jNpZvon229:kn1IOQzIGCOKb3Aih50eaQU5mHIRsUT2

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe

pid	process
2096	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
2096	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
2096	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
2096	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe

description	pid	process	target process
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2012 wrote to memory of 2092	2012	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
PID 2092 wrote to memory of 2096	2092	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe	042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\042f5809f529b9d06119953c1d3a2bbd_JaffaCakes118.exe"
3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\EymzjLLiT1jBJv8\1X1lo8OfyE6b.dll
Filesize
76KB

MD5
8d846381b5d810516eae3e524e642cf3

SHA1
63625f701ee3a41ff9c254fcf76fc1b23a8d4ee1

SHA256
93f22e354bd43ff42c88fa83f1ddc2ba2cd68624a948cd94c86a0a15c0167b71

SHA512
7a38f6eac6fa7a26919795dd5d57f474ed8b9de32b8304896000237a11cf9ebf8a935f732ede830d4fd71cd30514a9fcf9271352e9b0b271509d8f12be54f1e7

Download Submit
\Users\Admin\AppData\Local\Temp\EymzjLLiT1jBJv8\25Gi58S.dll
Filesize
202KB

MD5
7160ebc558a797f0dae8e1a4b24ed184

SHA1
1a08fd01e298d949ad93109fbc4870a28cfe6660

SHA256
cc19c4d2c90fb690db678846bc5545c134e0eca10a2d75cce1bb4f49c3428ef4

SHA512
b1a44e50f30f74fe75fddf9643368dbb22bfabbb1a72b710c8242d177fda4e0327f069ac3fa2bbb92ffe8554dd72509121336d316a272672d25e480e25692826

Download Submit
\Users\Admin\AppData\Local\Temp\EymzjLLiT1jBJv8\UugHSsEez1SsaBz1bCz1Ttz1fGhI67jKCc.dll
Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
\Users\Admin\AppData\Local\Temp\EymzjLLiT1jBJv8\lua51.dll
Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
memory/2096-18-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Filesize
64KB

Download
memory/2096-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-11-0x0000000000270000-0x00000000002A7000-memory.dmp

Filesize
220KB

Download
memory/2096-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-20-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/2096-5-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/2096-24-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/2096-28-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/2096-27-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/2096-26-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/2096-25-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download
memory/2096-29-0x000000007EF80000-0x000000007EF90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads