54d018497849e2ac5775780f6d77c0c8f646f2a4edc03ef4308e8d261b632327

General

Target

791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe
Size

40KB
MD5

791b92715787eacd65c5c592bb35e4b7
SHA1

0f82b65b6c55846b89b7e1cfe5cc8262d0dc02c4
SHA256

54d018497849e2ac5775780f6d77c0c8f646f2a4edc03ef4308e8d261b632327
SHA512

fa6732b9f8b4623b67ed21643efb26975b79e8e3666721e43cef41d64b7083ac4acae52b70ac2e1058f00a2bba02280a78d51d1ac56daf498c3a83cb428e1940
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHnvS:aqk/Zdic/qjh8w19JDHna

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2012	services.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x002d000000014a55-7.dat	upx
behavioral1/memory/2012-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-34-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2012-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe
File created	C:\Windows\services.exe	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2012	2248	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2012	2248	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2012	2248	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2012	2248	791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\791b92715787eacd65c5c592bb35e4b7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD2E9.tmp

Filesize
40KB

MD5
2ce7f275c305d6f1f85224f08104d24a

SHA1
875a11aaf9e6b12b0da6a71c709e4a6c3fe063e2

SHA256
ac6eb3fbe5368f329875cd14152f80d151e4ce8ba30f6b3cc92646781d3fa436

SHA512
177295c7e211887fec351b9cd0fb021df065e5cea8a07ece1163b1fb79d382783d68dcd8b282494f7fb146e1bad33f8c2485dd81c39c2204518f9f28c3877729

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
10014d114742be2b95ac8843dcf72490

SHA1
fe05545e70ef69496962f8db2350cb588cc64239

SHA256
7cc9ef4f294ec3bc01b8ab274d5f50d25d39915cbcf80f494e99c8857f5175ad

SHA512
0dc1cbc03fccdc587e8526b964a1b207f1d62387e49bd16c01aab45e2071166a1a2ae3a3bf25b443e816ce15a1e7d354c87adc0b17dbb3caae1ee2a0ca14c98b

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2012-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-34-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2012-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2248-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2248-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2248-21-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads