b3789019bc7ecce1616b06a69095decbbce8b2fa57c9d58883158b812d467299

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msmqinst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe"	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\nscygmbn.sys	wingb.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\csdlomd\ImagePath = "system32\\drivers\\nscygmbn.sys"	wingb.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	wingb.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2688	cmd.exe

Themida packer 27 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-2-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-3-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-4-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-5-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-6-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-7-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-8-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-9-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-10-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-11-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2688-18-0x0000000002390000-0x0000000002644000-memory.dmp	themida
behavioral1/memory/2860-26-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-28-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-29-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-30-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-32-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-33-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-34-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-35-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-36-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-37-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-38-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-39-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-40-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-41-0x0000000000890000-0x0000000001255000-memory.dmp	themida
behavioral1/memory/2860-42-0x0000000000890000-0x0000000001255000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002f000000014f57-14.dat	upx
behavioral1/memory/2420-24-0x0000000000400000-0x00000000006B4000-memory.dmp	upx
behavioral1/memory/2420-25-0x0000000000400000-0x00000000006B4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Cleanup = "C:\\cleanup.exe"	wingb.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\const 1.0.0	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\aiyiqweg.txt	wingb.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\Help\wuau\wingb.exe	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe
File created	C:\WINDOWS\Help\wuau\wingb.txt	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2420	wingb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2420	wingb.exe
2420	wingb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2688	2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2688	2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2688	2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2688	2860	07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe	28
PID 2688 wrote to memory of 2420	2688	cmd.exe	30
PID 2688 wrote to memory of 2420	2688	cmd.exe	30
PID 2688 wrote to memory of 2420	2688	cmd.exe	30
PID 2688 wrote to memory of 2420	2688	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07f55e1e2cb8a3fc094bbe5026c3df21_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /k C:\WINDOWS\Help\wuau\wingb.exe /nogui C:\WINDOWS\Help\wuau\wingb.txt
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\WINDOWS\Help\wuau\wingb.exe
    C:\WINDOWS\Help\wuau\wingb.exe /nogui C:\WINDOWS\Help\wuau\wingb.txt
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry