503ef81e6f8818b4a1a0012d045d8a1a433375cff6f554751fd430fe8234a45a

General

Target

04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
Size

108KB
MD5

04e4e986fb3025d5279cd7c51893247e
SHA1

cf743ea80ed77d3c74b17cf5610ca150207bc0cb
SHA256

503ef81e6f8818b4a1a0012d045d8a1a433375cff6f554751fd430fe8234a45a
SHA512

2fc41ad1151c5de8f3d48895e08a0d727e654414a25e74a4dd6d5b8678efaaf7995ce640ac233e4e347a11a86d209ad685a0c551465508ae353521ebbac97a6e
SSDEEP

768:0Xne9SLNE6yDCAtSt6b3yFhBVNsx4MOZjFB4xbyv0DVtaxuK9lta5qCqeq6qWqS2:0X9EZ1rahBY2VZjFK2sBt2tIA

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe
Disables Task Manager via registry modification
evasion

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iexplorer = "C:\\Windows\\iexplorer.exe"	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

description	pid	process	target process
PID 2740 set thread context of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

Processes:

04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

description	ioc	process
File created	C:\WINDOWS\system\wincal.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system\wincal.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
File created	C:\Windows\iexplorer.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
File opened for modification	C:\Windows\iexplorer.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2544 reg.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

pid process

2740 04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
3068 04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

pid	process
2544	reg.exe

pid	process
2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
3068	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 2740 wrote to memory of 3068	2740	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
PID 3068 wrote to memory of 2532	3068	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	cmd.exe
PID 3068 wrote to memory of 2532	3068	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	cmd.exe
PID 3068 wrote to memory of 2532	3068	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	cmd.exe
PID 3068 wrote to memory of 2532	3068	04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe	cmd.exe
PID 2532 wrote to memory of 2544	2532	cmd.exe	reg.exe
PID 2532 wrote to memory of 2544	2532	cmd.exe	reg.exe
PID 2532 wrote to memory of 2544	2532	cmd.exe	reg.exe
PID 2532 wrote to memory of 2544	2532	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740

C:\Users\Admin\AppData\Local\Temp\04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04e4e986fb3025d5279cd7c51893247e_JaffaCakes118.exe"
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- UAC bypass
- Modifies registry key
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\iexplorer.exe
Filesize
108KB

MD5
04e4e986fb3025d5279cd7c51893247e

SHA1
cf743ea80ed77d3c74b17cf5610ca150207bc0cb

SHA256
503ef81e6f8818b4a1a0012d045d8a1a433375cff6f554751fd430fe8234a45a

SHA512
2fc41ad1151c5de8f3d48895e08a0d727e654414a25e74a4dd6d5b8678efaaf7995ce640ac233e4e347a11a86d209ad685a0c551465508ae353521ebbac97a6e

Download Submit
memory/3068-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3068-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads