2a3be77b93ff0d06eaae843b581676156bf29b40dc188a6499107f4455f5b5ca

General

Target

04fb04161dd481a33f081cd93520615c_JaffaCakes118.exe
Size

87KB
MD5

04fb04161dd481a33f081cd93520615c
SHA1

1268c61e89ec85dd0848d5f7c721de3cdc2cfea7
SHA256

2a3be77b93ff0d06eaae843b581676156bf29b40dc188a6499107f4455f5b5ca
SHA512

37c5e1bd12dee380a0e9012640082a6157ad88d5303f3ee26497582f96ecdde508caf66721165bbfa62467661b2aa4f5f75de4a575451c96461b22d807c85d3b
SSDEEP

1536:R7yRvcyDA+2YTB9scpfhUlHJBfzvZ4ZUvff66kdnISJkk9gUO6CO/Urf1:Scy/l9scwlpdZPX66SIL/6COi1

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	alg.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	alg.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	04fb04161dd481a33f081cd93520615c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	alg.exe

Deletes itself 1 IoCs

pid	Process
1960	alg.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	alg.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	alg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\alg.exe	04fb04161dd481a33f081cd93520615c_JaffaCakes118.exe
File opened for modification	C:\Windows\alg.exe	04fb04161dd481a33f081cd93520615c_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	alg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	alg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	alg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	alg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	alg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	alg.exe

C:\Users\Admin\AppData\Local\Temp\04fb04161dd481a33f081cd93520615c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04fb04161dd481a33f081cd93520615c_JaffaCakes118.exe"
1⤵
- Looks for VMWare Tools registry key
- Drops file in Windows directory
PID:2392

C:\Windows\alg.exe
"C:\Windows\alg.exe"
1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\alg.exe

Filesize
87KB

MD5
04fb04161dd481a33f081cd93520615c

SHA1
1268c61e89ec85dd0848d5f7c721de3cdc2cfea7

SHA256
2a3be77b93ff0d06eaae843b581676156bf29b40dc188a6499107f4455f5b5ca

SHA512
37c5e1bd12dee380a0e9012640082a6157ad88d5303f3ee26497582f96ecdde508caf66721165bbfa62467661b2aa4f5f75de4a575451c96461b22d807c85d3b

Download Submit
memory/1960-20-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-16-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-8-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-14-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-24-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-10-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-11-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-12-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-23-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-13-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-7-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-17-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-18-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-19-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-22-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1960-21-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2392-1-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2392-2-0x0000000000485000-0x000000000049B000-memory.dmp

Filesize
88KB

Download
memory/2392-9-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads