770e13861e7e1715dcf73d475c44561dd1fb2d73f44755d9fe908ead3be0cd7b

General

Target

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
Size

140KB
MD5

6871259455c9585fee78d1344822d12e
SHA1

36587c4018ca62f3d6e01327cb107d3c93cbd8fe
SHA256

770e13861e7e1715dcf73d475c44561dd1fb2d73f44755d9fe908ead3be0cd7b
SHA512

bf32dffbefa5cc8dded4f6cdb850fed86367e596e3c23068745090ad3355c2065b8a963b14bab4284336602334cd6e212558de7b38420d454396a696090a714d
SSDEEP

1536:osTWDDkqee7SfZBTHCmUs+ILgJbVIQYf7g45ABm5iyKLYkhl6S78XCO3Kvn9vDJ7:PWfkqeII775ABmY4E8X0D1RCsc6I8D

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

schovt.exelsass.exe

pid process

3028 schovt.exe
2576 lsass.exe
Loads dropped DLL 2 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

pid process

3000 6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
3000 6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

pid	process
3028	schovt.exe
2576	lsass.exe

pid	process
3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

schovt.exelsass.exe6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet = "c:\\windows\\system32\\winUpdate.exe"	schovt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Messenger = "c:\\windows\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet	schovt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Messenger = "c:\\windows\\lsass.exe"	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Messenger = "c:\\windows\\lsass.exe"	schovt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "c:\\windows\\system32\\schovt.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet = "c:\\windows\\system32\\winUpdate.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "c:\\windows\\system32\\schovt.exe"	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "c:\\windows\\system32\\schovt.exe"	schovt.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

lsass.exe

description	ioc	process
File opened (read-only)	\??\b:	lsass.exe
File opened (read-only)	\??\e:	lsass.exe
File opened (read-only)	\??\g:	lsass.exe
File opened (read-only)	\??\h:	lsass.exe

Drops file in System32 directory 7 IoCs

Processes:

lsass.exe6871259455c9585fee78d1344822d12e_JaffaCakes118.exeschovt.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\winUpdate.exe	lsass.exe
File created	\??\c:\windows\SysWOW64\schovt.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\schovt.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\winUpdate.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\winUpdate.exe	schovt.exe
File opened for modification	\??\c:\windows\SysWOW64\winUpdate.exe	schovt.exe
File opened for modification	\??\c:\windows\SysWOW64\winUpdate.exe	lsass.exe

Drops file in Windows directory 2 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\windows\lsass.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File created	\??\c:\windows\lsass.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exeschovt.exelsass.exe

pid process

3000 6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
3028 schovt.exe
2576 lsass.exe

pid	process
3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
3028	schovt.exe
2576	lsass.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	pid	process	target process
PID 3000 wrote to memory of 3028	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 3000 wrote to memory of 3028	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 3000 wrote to memory of 3028	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 3000 wrote to memory of 3028	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 3000 wrote to memory of 2576	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe
PID 3000 wrote to memory of 2576	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe
PID 3000 wrote to memory of 2576	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe
PID 3000 wrote to memory of 2576	3000	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe

C:\Users\Admin\AppData\Local\Temp\6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6871259455c9585fee78d1344822d12e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000

C:\windows\SysWOW64\schovt.exe
"C:\windows\system32\schovt.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3028

C:\windows\lsass.exe
"C:\windows\lsass.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Readme.html
Filesize
452B

MD5
055580f9826540b05327daa15f2deb1d

SHA1
401361ced0387b624158f4531d7b42713a6741a3

SHA256
1d858e8be14ab8b5c41b5cbd592293247df08e9c8d2041d55cca2d00270dcc91

SHA512
55154f8d83835529129f90820d09f93cbd6d7de90ebb6feeaf65b07ce6a6a9f6ea047b7b6db344f86fe3f92c4324a8a6191e5a01d21caf2363df69f673dadac5

Download Submit
C:\Windows\SysWOW64\schovt.exe
Filesize
140KB

MD5
6871259455c9585fee78d1344822d12e

SHA1
36587c4018ca62f3d6e01327cb107d3c93cbd8fe

SHA256
770e13861e7e1715dcf73d475c44561dd1fb2d73f44755d9fe908ead3be0cd7b

SHA512
bf32dffbefa5cc8dded4f6cdb850fed86367e596e3c23068745090ad3355c2065b8a963b14bab4284336602334cd6e212558de7b38420d454396a696090a714d

Download Submit
\??\c:\windows\SysWOW64\winUpdate.exe
Filesize
63KB

MD5
2e2eb1929286786398710d377da1abbe

SHA1
3f4dc076a1533f8ead7a0a39b59a779b9ea6ce72

SHA256
57fe89dc233785aa4270f01ed4e1ad59858b1ff2f5a54170a91c6eaf4e320ca7

SHA512
4c5dd62bb263bf525f83653949768a80e48f0f7f2064c5acdc41874415e12f96f1cc40107ce49de0ddb400787cd0d8568db03a5a6b68c9223b15756f40470d62

Download Submit
memory/3000-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads