975055a1d758d47c17f851e0597d3b6a65f6d9f71e59263bb5b27f84e5542af2

General

Target

0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe
Size

685KB
MD5

0ce0fd9b5710e958f3810fd1c6ef8fb5
SHA1

3ddf7f4806c60771df1208add61ce5249f402516
SHA256

975055a1d758d47c17f851e0597d3b6a65f6d9f71e59263bb5b27f84e5542af2
SHA512

3fa9d67957db2c1603cfa166c3d3e7ac336c467ad58bbf288d8f74b6302c5c73861bd0dcafb586b3960fb92dd46f9382fb77187c2fb054820d41f2badc8dffe8
SSDEEP

12288:Hr187z10OQOh3ZSmRqd5lx/+TNYmkWF3Z4mxx+DqVTVOCW:Hr1kR0OH3SmRqd5X/fWQmXNVTzW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4312	Server.exe
324	Hacker.com.cn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	Server.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	Server.exe
File created	C:\Windows\uninstal.bat	Server.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	Server.exe
Token: SeDebugPrivilege	324	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
324	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4312	2188	0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe	81
PID 2188 wrote to memory of 4312	2188	0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe	81
PID 2188 wrote to memory of 4312	2188	0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe	81
PID 324 wrote to memory of 4496	324	Hacker.com.cn.exe	83
PID 324 wrote to memory of 4496	324	Hacker.com.cn.exe	83
PID 4312 wrote to memory of 2572	4312	Server.exe	84
PID 4312 wrote to memory of 2572	4312	Server.exe	84
PID 4312 wrote to memory of 2572	4312	Server.exe	84

C:\Users\Admin\AppData\Local\Temp\0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ce0fd9b5710e958f3810fd1c6ef8fb5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
    3⤵
    PID:2572

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:324
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe

Filesize
743KB

MD5
7034c65c49f24c5478410a0b74772da1

SHA1
2a95679ec3335d04cf6936a630d64bb8fad2010d

SHA256
1017307d2218edc1fd46c53c125aa1f9cfb3e3fd1064fdc8f59db3f54eee20da

SHA512
3c2700e2057089613454e011d7912e8a697415c1415d834d535b7517cef8c641ad6579af10108e723d7b7cf74f3128a03341b50e426d3484ce12d2d3122c267c

Download Submit
C:\Windows\uninstal.bat

Filesize
160B

MD5
69e01c599950b5caf5cd7ec972f89682

SHA1
2d34ceced77c1f86417c00f706e06cc902b11e3b

SHA256
b46da5e666a34856e6f9763f5bef2a4879b4d33f42ea1727be44a84e76fc8e5e

SHA512
48acf4f4b87eb21a255003a18ed572efb78d5c3ad90b4529bbb16dd32b53142c8f08fe4f567d29115e2ac1fb543f71c1b9ac3dc79cc14afda84c67f72ff11ba9

Download Submit
memory/324-35-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/324-34-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2188-6-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/2188-13-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/2188-0-0x0000000001000000-0x000000000110E000-memory.dmp

Filesize
1.1MB

Download
memory/2188-5-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2188-10-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/2188-4-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/2188-3-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2188-17-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/2188-16-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/2188-15-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/2188-14-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/2188-7-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/2188-12-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/2188-11-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/2188-8-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/2188-1-0x0000000000580000-0x00000000005D4000-memory.dmp

Filesize
336KB

Download
memory/2188-32-0x0000000000580000-0x00000000005D4000-memory.dmp

Filesize
336KB

Download
memory/2188-31-0x0000000001000000-0x000000000110E000-memory.dmp

Filesize
1.1MB

Download
memory/2188-9-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/2188-2-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/4312-29-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads