6cab3dca7b74e6f38f224ba1f35b1bcff8ef4f54c14a3b10eb2fb67b86bc43b8

General

Target

0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
Size

159KB
MD5

0b0f13ee90f164862c79195be5aea92b
SHA1

670232571a1ef2521e649819262bc5ac531f5ea6
SHA256

6cab3dca7b74e6f38f224ba1f35b1bcff8ef4f54c14a3b10eb2fb67b86bc43b8
SHA512

ac0e4fc0e7a6285d729601b7e06acdd306b4180cec30f1c5547d50f2b94e8c8b5ff02edf23faf0242dc98f11fb3d503b70a465a387af7e92032ace2f4e080a81
SSDEEP

3072:ra1KZN8FVAenR7uHUeCBNxgJ9zSQRef+f:ra1G8FVA6aHUB87WQRew

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winsvc.exe

pid process

2840 winsvc.exe
Loads dropped DLL 2 IoCs

Processes:

0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

pid process

2224 0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224 0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

pid	process
2840	winsvc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-57404750404665040\\winsvc.exe"	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-57404750404665040\\winsvc.exe"	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\T-57404750404665040\winsvc.exe	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
File opened for modification	C:\Windows\T-57404750404665040\winsvc.exe	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
File opened for modification	C:\Windows\T-57404750404665040	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exewinsvc.exe

pid	process
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe
2840	winsvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe

description	pid	process	target process
PID 2224 wrote to memory of 2840	2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe	winsvc.exe
PID 2224 wrote to memory of 2840	2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe	winsvc.exe
PID 2224 wrote to memory of 2840	2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe	winsvc.exe
PID 2224 wrote to memory of 2840	2224	0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe	winsvc.exe

C:\Users\Admin\AppData\Local\Temp\0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b0f13ee90f164862c79195be5aea92b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\T-57404750404665040\winsvc.exe
C:\Windows\T-57404750404665040\winsvc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\T-57404750404665040\winsvc.exe
Filesize
159KB

MD5
0b0f13ee90f164862c79195be5aea92b

SHA1
670232571a1ef2521e649819262bc5ac531f5ea6

SHA256
6cab3dca7b74e6f38f224ba1f35b1bcff8ef4f54c14a3b10eb2fb67b86bc43b8

SHA512
ac0e4fc0e7a6285d729601b7e06acdd306b4180cec30f1c5547d50f2b94e8c8b5ff02edf23faf0242dc98f11fb3d503b70a465a387af7e92032ace2f4e080a81

Download Submit
memory/2224-2-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download
memory/2224-3-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2840-15-0x0000000000500000-0x0000000000600000-memory.dmp

Filesize
1024KB

Download
memory/2840-16-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2840-21-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2840-23-0x0000000000500000-0x0000000000600000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads