d4d80d54179bbed4f44d6249c0aa680c85dd97801959a0f2d191c5da68865f41

General

Target

01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe
Size

56KB
MD5

01f996620036d7ac9295383ba69817a4
SHA1

c7184225d253872b7154c7bff673d7a371ae6328
SHA256

d4d80d54179bbed4f44d6249c0aa680c85dd97801959a0f2d191c5da68865f41
SHA512

279fd63f248570f37c2f62573c919dc9fd4601f3992f98f66c70b06b4fd81e6b39fa46e2db2ffcbe41520d5f4dc42bf16971c00cf2966c9383d3131ff4870b5e
SSDEEP

1536:ABZO6g1421KrGwpUwI/hCDBbR78DGVBv:ABZO/4+4Gp3/hCLMG3

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023647-30.dat	aspack_v212_v242

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system32\\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system32\\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system32\\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system32\\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SharedAPPs = "C:\\Windows\\system32\\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe"	regedit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\msapps\msapp.dll	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe
File opened for modification	C:\Windows\msapps\msapp.dll	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe

Runs .reg file with regedit 5 IoCs

pid	Process
3544	regedit.exe
4872	regedit.exe
368	regedit.exe
1008	regedit.exe
4364	regedit.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4364	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	90
PID 4200 wrote to memory of 4364	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	90
PID 4200 wrote to memory of 4364	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	90
PID 4200 wrote to memory of 3544	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	103
PID 4200 wrote to memory of 3544	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	103
PID 4200 wrote to memory of 3544	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	103
PID 4200 wrote to memory of 4872	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	106
PID 4200 wrote to memory of 4872	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	106
PID 4200 wrote to memory of 4872	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	106
PID 4200 wrote to memory of 368	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	109
PID 4200 wrote to memory of 368	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	109
PID 4200 wrote to memory of 368	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	109
PID 4200 wrote to memory of 1008	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	117
PID 4200 wrote to memory of 1008	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	117
PID 4200 wrote to memory of 1008	4200	01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:4364
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:3544
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:4872
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:368
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Windowssharedapp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3584,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\01f996620036d7ac9295383ba69817a4_JaffaCakes118.exe

Filesize
56KB

MD5
01f996620036d7ac9295383ba69817a4

SHA1
c7184225d253872b7154c7bff673d7a371ae6328

SHA256
d4d80d54179bbed4f44d6249c0aa680c85dd97801959a0f2d191c5da68865f41

SHA512
279fd63f248570f37c2f62573c919dc9fd4601f3992f98f66c70b06b4fd81e6b39fa46e2db2ffcbe41520d5f4dc42bf16971c00cf2966c9383d3131ff4870b5e

Download Submit
C:\Windows\msapps\msapp.dll

Filesize
1KB

MD5
bcba9d21cdf4dc5684529857941cff22

SHA1
c1542b62871eea55ec5d30ff5d6482c6c59d89b0

SHA256
1c43edf58e344db8e22bd38c1fc8427f125bb03d9bdf37d2a61aff3299912bcb

SHA512
1a024ef62dbc44ebed36dd28c23a6fddf28888aaed6132cb16b878aed8cd43bfcf5cf48b5460e8fa65735727447f629642a50fae11c98c49f8d5c4ee6d0e30fc

Download Submit
C:\Windowssharedapp.reg

Filesize
198B

MD5
ba19d0d8070a935a7ec421d4c0057d42

SHA1
77094d67ba543abe8fb7c27d02a1ee34c5959602

SHA256
dedb1706ffb2a5b10dfe8f55b5db240c494d19f0a6f86f915d97b803fe000e6b

SHA512
1e28196d0604183f4fb033322647a95847002494bc6ce57912dcf5444e88fc77c44feed5cb993b58feeae0e27ec56899da5d52172f46d65b876160629f4b5215

Download Submit
memory/4200-4-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-25-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-27-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4200-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads