97f5bc6472abf92e2541c910f4d3d494a512dde4b753a910dae62fb2bebaf0e4

General

Target

68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe
Size

40KB
MD5

68eeb7b0afcf4a2bb811420919b4fd1a
SHA1

1de0bf4c1855d63155b3612889afdc486a97b38e
SHA256

97f5bc6472abf92e2541c910f4d3d494a512dde4b753a910dae62fb2bebaf0e4
SHA512

390d92337dfc76dc1acc0de1139be4b2e026d67b086182d472e198ab37f3249eb556c63a9ec9bd7f3119f690b065ee1ca24b98f789a470251520a8027a2972a2
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH/OV:aqk/Zdic/qjh8w19JDH/Y

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2852 services.exe

pid	process
2852	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\services.exe	upx
behavioral1/memory/2852-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2852-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\services.exe	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe
File created	C:\Windows\java.exe	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe

description	pid	process	target process
PID 2196 wrote to memory of 2852	2196	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe	services.exe
PID 2196 wrote to memory of 2852	2196	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe	services.exe
PID 2196 wrote to memory of 2852	2196	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe	services.exe
PID 2196 wrote to memory of 2852	2196	68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68eeb7b0afcf4a2bb811420919b4fd1a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nhElkwbtb.log

Filesize
1KB

MD5
18cc88b1092527c35348a4deab684cc0

SHA1
2e053e272ef192e5ea46ede2458db89e32ebeb21

SHA256
362a4d569a2c91b3664867e9c99c3c01f92fde43fb59f63be1d4825b381bf452

SHA512
52d55628404b07c34c40e5362d0c9d06295cf18e21344168de29c39bcbcc83c62efd9a98732cfcc0100090d4d9aeb08b3852f12d05aa5b60d0b5021e751273b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9DF4.tmp

Filesize
40KB

MD5
6758e035158028fe7f5b516bc59a3555

SHA1
5f31f4fdf66170effb59d069181f63193337ac4a

SHA256
8306496a7e71fe0c01dc283a0407ea64e725bb439f86870a0e9365cf14cd0d77

SHA512
9ad74c5e6d99a4d345dd540b934ba455e3d01e4609bb6afe8dcd9e18c302d7046f69dc6a9280938488565f85bdaedd3ea108e0cc7966dc71e6b261996621b19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f0c3977791bdeacb8e5d1ac9e59fa3da

SHA1
d3ffe1c52295ef6aeb650a381372c833e9fbd017

SHA256
0a37f76a67392f3799c586ce2e48cb6aab0b43d477284162de81187e93f005a4

SHA512
46d814156c45c5f98b4c25b9855fa6c8ec328cfcbfce69f29994da2141efd01a107568772b1b2631f4359f57de5e167dd2c7cb2b4998ac0e8afb32e9bf8a6ad5

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2196-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2196-10-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2196-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2196-22-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2196-23-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2852-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2852-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads