6de34bc98ea9fcbffd71cec5a8f27d5be72be4be66a02901ab50ebba41966074

General

Target

7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe
Size

239KB
MD5

7f54ce5d333ece9d5ab0a9da00f3bbd6
SHA1

ff86448a5bf56096395137d7c69551a2cca52cb1
SHA256

6de34bc98ea9fcbffd71cec5a8f27d5be72be4be66a02901ab50ebba41966074
SHA512

713f35072d2009d6fd172570075b54491f360240b0c6f9405e2e4cb196a7f5949b15d1a8b834a023afb6419654a775019735a6e61cf080276b94b8d9d1dbefb4
SSDEEP

3072:qTVVT0gg95XtpbjVOdeFdeLHE0jiNFxxr5tYE3cxDwcrtfx:YTBO5tpFOydeLpjiNDxHn3cRfVx

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	winnmtr.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winnmtr.exe

Executes dropped EXE 1 IoCs

pid	Process
1636	winnmtr.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winnmtr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	winnmtr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\81231010913223681\\winnmtr.exe"	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Services = "C:\\Windows\\81231010913223681\\winnmtr.exe"	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\81231010913223681\winnmtr.exe	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe
File opened for modification	C:\Windows\81231010913223681\winnmtr.exe	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe
File opened for modification	C:\Windows\81231010913223681	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1636	1104	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe	91
PID 1104 wrote to memory of 1636	1104	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe	91
PID 1104 wrote to memory of 1636	1104	7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7f54ce5d333ece9d5ab0a9da00f3bbd6_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\81231010913223681\winnmtr.exe
  C:\Windows\81231010913223681\winnmtr.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\81231010913223681\winnmtr.exe

Filesize
239KB

MD5
7f54ce5d333ece9d5ab0a9da00f3bbd6

SHA1
ff86448a5bf56096395137d7c69551a2cca52cb1

SHA256
6de34bc98ea9fcbffd71cec5a8f27d5be72be4be66a02901ab50ebba41966074

SHA512
713f35072d2009d6fd172570075b54491f360240b0c6f9405e2e4cb196a7f5949b15d1a8b834a023afb6419654a775019735a6e61cf080276b94b8d9d1dbefb4

Download Submit
memory/1104-1-0x00000000008A0000-0x00000000009A0000-memory.dmp

Filesize
1024KB

Download
memory/1104-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1104-3-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1104-9-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1636-11-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1636-12-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1636-13-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads