f4ab1818af8ebd8e5b6763243fefa96c86db69c62f00cb564198ff6149a4e10b

General

Target

63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe
Size

496KB
MD5

63f020fdd37d5fbbd716dc5e43d8dbae
SHA1

1fb907f9202dee3b00adfe43f41dc4772d8572d1
SHA256

f4ab1818af8ebd8e5b6763243fefa96c86db69c62f00cb564198ff6149a4e10b
SHA512

5af616252f2a6fd1db1d84804725ad90ec28ae113ee2f5c10d5c6529a10a119f45a10621c93df3f10497d014c2e9a2474e551cfd2080bbd16ecc74a97d11ef31
SSDEEP

12288:545fonA3GvLnRJAGhfXt+bulIzxbss7fLOR:5A+rFXtMXGzR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe

pid	process
1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
836	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
1696	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe

Loads dropped DLL 1 IoCs

Processes:

63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe

pid process

2292 63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ipecho.net
4 api.ipify.org

flow	ioc
2	ipecho.net
4	api.ipify.org

Suspicious use of UnmapMainImage 4 IoCs

Processes:

63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe

pid	process
2292	63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe
1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
836	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
1696	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe

description	pid	process	target process
PID 2292 wrote to memory of 1536	2292	63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
PID 2292 wrote to memory of 1536	2292	63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
PID 2292 wrote to memory of 1536	2292	63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
PID 2292 wrote to memory of 1536	2292	63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe
PID 1536 wrote to memory of 2660	1536	52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63f020fdd37d5fbbd716dc5e43d8dbae_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2292

C:\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
C:\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:2660

C:\Windows\system32\taskeng.exe
taskeng.exe {4DB7DF49-5339-4959-8EC8-6C0D18D0C2C7} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:456

C:\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
C:\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:836

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:2576

C:\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
C:\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1696

C:\Windows\system32\svchost.exe
svchost.exe -k netsvcs
3⤵
PID:2948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winapp\client_id
Filesize
100B

MD5
c9f3e89f5ba156e2ea44eecca4f2a90c

SHA1
21ae79dfe041441fe6821d023d3129de89f99156

SHA256
9507da60e0cc5eda0a7b2a4b3dc0ae41bfd548aab0ea8c1db5ddc410da032185

SHA512
cb6c2997203919ceffec9187e75a8e873eaab08d9d841ed2812acc06e9e95e8867e2f56bd22075c96d39d2886b30e13df24f26f033b3d8eb48bd5f824a098b39

Download Submit
\Users\Admin\AppData\Roaming\winapp\52e010ecc26c4eaac605cb4d32c7caad_IaeeaBajdr007.exe
Filesize
496KB

MD5
63f020fdd37d5fbbd716dc5e43d8dbae

SHA1
1fb907f9202dee3b00adfe43f41dc4772d8572d1

SHA256
f4ab1818af8ebd8e5b6763243fefa96c86db69c62f00cb564198ff6149a4e10b

SHA512
5af616252f2a6fd1db1d84804725ad90ec28ae113ee2f5c10d5c6529a10a119f45a10621c93df3f10497d014c2e9a2474e551cfd2080bbd16ecc74a97d11ef31

Download Submit
memory/836-53-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1536-20-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1536-14-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1536-25-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1536-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-1-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2292-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-0-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/2576-46-0x0000000140000000-0x0000000140025000-memory.dmp

Filesize
148KB

Download
memory/2660-27-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2660-28-0x0000000140000000-0x0000000140025000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads