b072d29bae0d53dfd1a70bc48cacc559535020d6e2b2039f8acdd53fe22053b9

General

Target

01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
Size

114KB
MD5

01e93179d45a85ae8e88eb0dc78e90cf
SHA1

8c7207b5fbabe284ba0e080f1d73061a4ce0c294
SHA256

b072d29bae0d53dfd1a70bc48cacc559535020d6e2b2039f8acdd53fe22053b9
SHA512

0658da2ee6965e992542312a7b80a486403659dc0a42b4efa9b8239aa4ef69eec16c072ec08db50fa01dcecbee6953ef0fda056c998df349d29652dcf336cfff
SSDEEP

3072:TtcIf1MhEYUla/VKZqDPJ9ZtpJgptHVMCd:JcISEq0qLRJg3Vdd

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Sdzlzd.exe

pid process

2616 Sdzlzd.exe
Loads dropped DLL 2 IoCs

Processes:

01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

pid process

3056 01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
3056 01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

pid	process
2616	Sdzlzd.exe

pid	process
3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sdzlzd = "C:\\Users\\Admin\\AppData\\Roaming\\Sdzlzd.exe"	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

description	pid	process	target process
PID 1760 set thread context of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

pid process

3056 01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

pid	process
3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe

description	pid	process	target process
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 1760 wrote to memory of 3056	1760	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
PID 3056 wrote to memory of 2616	3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	Sdzlzd.exe
PID 3056 wrote to memory of 2616	3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	Sdzlzd.exe
PID 3056 wrote to memory of 2616	3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	Sdzlzd.exe
PID 3056 wrote to memory of 2616	3056	01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe	Sdzlzd.exe

C:\Users\Admin\AppData\Local\Temp\01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\01e93179d45a85ae8e88eb0dc78e90cf_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Roaming\Sdzlzd.exe
    "C:\Users\Admin\AppData\Roaming\Sdzlzd.exe"
    3⤵
    - Executes dropped EXE
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sdzlzd.exe

Filesize
114KB

MD5
01e93179d45a85ae8e88eb0dc78e90cf

SHA1
8c7207b5fbabe284ba0e080f1d73061a4ce0c294

SHA256
b072d29bae0d53dfd1a70bc48cacc559535020d6e2b2039f8acdd53fe22053b9

SHA512
0658da2ee6965e992542312a7b80a486403659dc0a42b4efa9b8239aa4ef69eec16c072ec08db50fa01dcecbee6953ef0fda056c998df349d29652dcf336cfff

Download Submit
memory/3056-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3056-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads