74f0bb272728ada75890501eb1d79d3a48e772da6d803328046dbca1e0224d40

General

Target

51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe
Size

254KB
MD5

51d6028a5b5c744d0506810950cff00e
SHA1

c2d855fa7c2ab6ec2d8399733747869a131c2c2a
SHA256

74f0bb272728ada75890501eb1d79d3a48e772da6d803328046dbca1e0224d40
SHA512

b47aaa98a74122c0c3b6da3acf544c8336961952fcbb2974e8d027273e31e2afc0d516bc01b72b80f12a58b3c644cc7135d426aecb2576d83952a70a86a8ca43
SSDEEP

6144:sZJt+EA3kZL+lUf44BgE+4MLzuT3V6Vg:sZJt+EAsYUg4m1BLyhL

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winybqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winybqi.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winybqi.exe

Executes dropped EXE 1 IoCs

pid	Process
2396	winybqi.exe

Loads dropped DLL 2 IoCs

pid	Process
2236	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe
2236	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winybqi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winybqi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\8057653018481650\\winybqi.exe"	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\8057653018481650\\winybqi.exe"	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\8057653018481650\winybqi.exe	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe
File opened for modification	C:\Windows\8057653018481650\winybqi.exe	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe
File opened for modification	C:\Windows\8057653018481650	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2396	2236	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2396	2236	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2396	2236	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2396	2236	51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\51d6028a5b5c744d0506810950cff00e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\8057653018481650\winybqi.exe
  C:\Windows\8057653018481650\winybqi.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\8057653018481650\winybqi.exe

Filesize
254KB

MD5
51d6028a5b5c744d0506810950cff00e

SHA1
c2d855fa7c2ab6ec2d8399733747869a131c2c2a

SHA256
74f0bb272728ada75890501eb1d79d3a48e772da6d803328046dbca1e0224d40

SHA512
b47aaa98a74122c0c3b6da3acf544c8336961952fcbb2974e8d027273e31e2afc0d516bc01b72b80f12a58b3c644cc7135d426aecb2576d83952a70a86a8ca43

Download Submit
memory/2236-1-0x0000000005280000-0x0000000005380000-memory.dmp

Filesize
1024KB

Download
memory/2236-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2236-13-0x0000000000400000-0x00000000051A2000-memory.dmp

Filesize
77.6MB

Download
memory/2396-15-0x0000000000400000-0x00000000051A2000-memory.dmp

Filesize
77.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads