529bc50ffc87c4f69c2fe0f77b7acc2b1b10cdd6f2d157d0608d1875beab86ed

General

Target

5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe
Size

40KB
MD5

5d7b471d4336f3f6c44b929d27c966f8
SHA1

7b61c9e97eb4549621c8042eab258256cae870da
SHA256

529bc50ffc87c4f69c2fe0f77b7acc2b1b10cdd6f2d157d0608d1875beab86ed
SHA512

0aa9fd7c545317ac5a962c609b6610d4fbff3ee65f1a7a725b72c64554a63b313eaee8c60c0264118a2f2820a3762a2136e14ac9a42c7df68fcbeedd58f7e3ed
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH6U:aqk/Zdic/qjh8w19JDH6U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3660	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023417-4.dat	upx
behavioral2/memory/3660-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-178-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-181-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3660-186-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe
File created	C:\Windows\services.exe	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3660	4524	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe	83
PID 4524 wrote to memory of 3660	4524	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe	83
PID 4524 wrote to memory of 3660	4524	5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d7b471d4336f3f6c44b929d27c966f8_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\79ZXHV21\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD678.tmp

Filesize
40KB

MD5
e3c64f1ddf45a49fb0b998337c376936

SHA1
d4027f414c0cf55cb3e82f2848c77b6d330e5267

SHA256
fc5aa92f829e6d3e945fb2fc174671b4a2e81e3320c11d4f28eeecea6808b152

SHA512
a80b3aaf8ab587bb42f48ea2bf84625221afe567627eabdbe4480e7879f1577c89af4d074fb01dbcf13b217e5a38322e26e5f74370398172fe8a4ae51f8ee2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
7c4f9255cc2ec3ef7a15cbfca66c7ade

SHA1
f788b26f1fa0f63c7738cca0fdc2dd9ae2594659

SHA256
31f3218079193b1ca2344a9a72f606bfbf7e8d7dba18b8ada83b7c483b35798a

SHA512
2379c1d655fcda9d43fbee99bc83fc646df2119726df41c32c298a1edcf0fb0aaabc4a07c228357622b09361866daef0d18fef619c722eaadde995f00868f980

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
1bd4bdc15af3af33d837cbd21ca2df73

SHA1
684af31c54be3322d81c0cd7305291e2b7023209

SHA256
bf78e914bace4b6d9d80eb93df935e69db06913ad8326668e9ab76eed9580807

SHA512
07ef4b270c9250ff143a1cc9ae862a1b83b13eec4f36557790f729d0c91af15e5adeac86de089c70d23c203d112c43490f4feaab7e9f00a0bcb273f80e1fa9c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
b16e2092bb364f365de6c2a378415d31

SHA1
bdb0ef06d9b493f8ecc3761a649b95a433ca5a65

SHA256
7dcb7ea61e6851db60c5dc6285b2b4d8443488989bc368b2efa4b7057071e28b

SHA512
bbe319e9a5ff57022f7631653e6f6e0eac64ba63dae321ab1bada044e2c4e6f942b195e07814df71990531d91270fcf725de45c9379978e8c32f7896ab2a350d

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3660-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-178-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-181-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3660-186-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4524-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads