f235f09827ef4b566a6921257bcca5d22b2e07221d37a549694027f83cacb6a0

General

Target

04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
Size

876KB
MD5

04db51832e10cfd65059d289fb9f08c6
SHA1

79767e5fe92a491dbd4f2354dc0e120d8374b5e3
SHA256

f235f09827ef4b566a6921257bcca5d22b2e07221d37a549694027f83cacb6a0
SHA512

4481d4d6bfe0edf9a71fe9ac0cbc99f4d1182bbf57a32b1ed916ea34f1bfa9b200cfe02e9313005110597e94588744a85e8e0bd9d629025f60697eb0e07ded78
SSDEEP

24576:dYMLKmtvPyHu71iNpRiby9pNg4W7HMeG3bOAHCwBg:uiKmHyO0Pwp7s1w

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe

pid	process
1812	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
1812	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
1812	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
1812	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe

description	pid	process	target process
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2180 wrote to memory of 2044	2180	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
PID 2044 wrote to memory of 1812	2044	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe	04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04db51832e10cfd65059d289fb9f08c6_JaffaCakes118.exe"
3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1812

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\46yDXMA2Su5bc8rD2ee\extramod.dll
Filesize
73KB

MD5
fb60ba7ef530e0ec3844f0090dbeba80

SHA1
81bceda0455fa6733d9ff6023eb7a4add3f45da2

SHA256
c9a466b02fcf12a9451581cc34b17711aebb208ef6d59a3a9352c400721f1f12

SHA512
bb23caaaca156dc7a4ba46ebe5f0da443b6cbeaefc5beafb55762015c60f35f794e1ae2036fc95f69921401f91a9bf9590dc96415d60204e060de4a6a188b297

Download Submit
\Users\Admin\AppData\Local\Temp\46yDXMA2Su5bc8rD2ee\loading_screen.dll
Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
\Users\Admin\AppData\Local\Temp\46yDXMA2Su5bc8rD2ee\lua51.dll
Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
\Users\Admin\AppData\Local\Temp\46yDXMA2Su5bc8rD2ee\shared_library.dll
Filesize
200KB

MD5
9a1841877cf77155597a8b97f8c2ce1b

SHA1
d58e96337cd5a045e5c51ccf2dfb26f8b66d0a5d

SHA256
894a9a91ef73dc006f58dba9c0bc15860b23c6994a82e0029d52914845ec1f96

SHA512
18206c0c15e8eb956bbdcbdae893b907857fd2860fd247304f61663af5f69041b0594f380738b872cf8148b5f05d97918e6201c6d133c0397122664f80c8b583

Download Submit
memory/1812-5-0x00000000001E0000-0x00000000001F6000-memory.dmp

Filesize
88KB

Download
memory/1812-10-0x0000000000290000-0x00000000002C6000-memory.dmp

Filesize
216KB

Download
memory/1812-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

Filesize
64KB

Download
memory/1812-14-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Filesize
64KB

Download
memory/1812-20-0x000000007EF00000-0x000000007EF10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads