770e13861e7e1715dcf73d475c44561dd1fb2d73f44755d9fe908ead3be0cd7b

General

Target

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
Size

140KB
MD5

6871259455c9585fee78d1344822d12e
SHA1

36587c4018ca62f3d6e01327cb107d3c93cbd8fe
SHA256

770e13861e7e1715dcf73d475c44561dd1fb2d73f44755d9fe908ead3be0cd7b
SHA512

bf32dffbefa5cc8dded4f6cdb850fed86367e596e3c23068745090ad3355c2065b8a963b14bab4284336602334cd6e212558de7b38420d454396a696090a714d
SSDEEP

1536:osTWDDkqee7SfZBTHCmUs+ILgJbVIQYf7g45ABm5iyKLYkhl6S78XCO3Kvn9vDJ7:PWfkqeII775ABmY4E8X0D1RCsc6I8D

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

schovt.exelsass.exe

pid process

3888 schovt.exe
4584 lsass.exe

pid	process
3888	schovt.exe
4584	lsass.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lsass.exeschovt.exe6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "c:\\windows\\system32\\schovt.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Messenger = "c:\\windows\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet = "c:\\windows\\system32\\winUpdate.exe"	schovt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet = "c:\\windows\\system32\\winUpdate.exe"	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "c:\\windows\\system32\\schovt.exe"	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Messenger = "c:\\windows\\lsass.exe"	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet	schovt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "c:\\windows\\system32\\schovt.exe"	schovt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Messenger = "c:\\windows\\lsass.exe"	schovt.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

lsass.exe

description	ioc	process
File opened (read-only)	\??\b:	lsass.exe
File opened (read-only)	\??\e:	lsass.exe
File opened (read-only)	\??\g:	lsass.exe
File opened (read-only)	\??\h:	lsass.exe

Drops file in System32 directory 7 IoCs

Processes:

lsass.exe6871259455c9585fee78d1344822d12e_JaffaCakes118.exeschovt.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\winUpdate.exe	lsass.exe
File created	\??\c:\windows\SysWOW64\schovt.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\schovt.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\winUpdate.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\winUpdate.exe	schovt.exe
File opened for modification	\??\c:\windows\SysWOW64\winUpdate.exe	schovt.exe
File opened for modification	\??\c:\windows\SysWOW64\winUpdate.exe	lsass.exe

Drops file in Windows directory 2 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\windows\lsass.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
File created	\??\c:\windows\lsass.exe	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

lsass.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings lsass.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

lsass.exe

pid process

4584 lsass.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exeschovt.exelsass.exe

pid process

4856 6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
3888 schovt.exe
4584 lsass.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	lsass.exe

pid	process
4584	lsass.exe

pid	process
4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
3888	schovt.exe
4584	lsass.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6871259455c9585fee78d1344822d12e_JaffaCakes118.exe

description	pid	process	target process
PID 4856 wrote to memory of 3888	4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 4856 wrote to memory of 3888	4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 4856 wrote to memory of 3888	4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	schovt.exe
PID 4856 wrote to memory of 4584	4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe
PID 4856 wrote to memory of 4584	4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe
PID 4856 wrote to memory of 4584	4856	6871259455c9585fee78d1344822d12e_JaffaCakes118.exe	lsass.exe

C:\Users\Admin\AppData\Local\Temp\6871259455c9585fee78d1344822d12e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6871259455c9585fee78d1344822d12e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856

C:\windows\SysWOW64\schovt.exe
"C:\windows\system32\schovt.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3888

C:\windows\lsass.exe
"C:\windows\lsass.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Readme.html

Filesize
452B

MD5
055580f9826540b05327daa15f2deb1d

SHA1
401361ced0387b624158f4531d7b42713a6741a3

SHA256
1d858e8be14ab8b5c41b5cbd592293247df08e9c8d2041d55cca2d00270dcc91

SHA512
55154f8d83835529129f90820d09f93cbd6d7de90ebb6feeaf65b07ce6a6a9f6ea047b7b6db344f86fe3f92c4324a8a6191e5a01d21caf2363df69f673dadac5

Download Submit
C:\Windows\SysWOW64\schovt.exe

Filesize
140KB

MD5
6871259455c9585fee78d1344822d12e

SHA1
36587c4018ca62f3d6e01327cb107d3c93cbd8fe

SHA256
770e13861e7e1715dcf73d475c44561dd1fb2d73f44755d9fe908ead3be0cd7b

SHA512
bf32dffbefa5cc8dded4f6cdb850fed86367e596e3c23068745090ad3355c2065b8a963b14bab4284336602334cd6e212558de7b38420d454396a696090a714d

Download Submit
memory/4856-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads