b2001c6fb9e6edfab6bd6bb9775f642db5a50e87b32a5338cd0a2840438a8035

General

Target

0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe
Size

89KB
MD5

0ce28d473522a1dc8d607c6b7bc04340
SHA1

791c10809b451a3389d10121e498cdb26743f74f
SHA256

b2001c6fb9e6edfab6bd6bb9775f642db5a50e87b32a5338cd0a2840438a8035
SHA512

61d10b45e2b922ce313260baa4414ebb938416eb53f82c8f864c480ce9d3d9a8c740a101dc8bb242c0cd55e2bc84052611f6e9dd90185be10fdf67c6967d9460
SSDEEP

1536:fY58guGP1LpkerJRYr+jCAF/BpnaMlaPXgwR3u4:fY5881medZjCKJphlIQUp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5088	teskmgrs.exe
3756	teskmgrs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mircosoft Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\teskmgrs.exe"	teskmgrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mircosoft Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\teskmgrs.exe"	teskmgrs.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\systeme.acm	teskmgrs.exe
File opened for modification	C:\Windows\SysWOW64\systeme.acm	teskmgrs.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3776 set thread context of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 5088 set thread context of 3756	5088	teskmgrs.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	3776	WerFault.exe	81

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 3776 wrote to memory of 2468	3776	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	85
PID 2468 wrote to memory of 5088	2468	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	89
PID 2468 wrote to memory of 5088	2468	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	89
PID 2468 wrote to memory of 5088	2468	0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe	89
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90
PID 5088 wrote to memory of 3756	5088	teskmgrs.exe	90

C:\Users\Admin\AppData\Local\Temp\0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Temp\0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0ce28d473522a1dc8d607c6b7bc04340_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Roaming\teskmgrs.exe
    "C:\Users\Admin\AppData\Roaming\\teskmgrs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Roaming\teskmgrs.exe
      "C:\Users\Admin\AppData\Roaming\teskmgrs.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 320
  2⤵
  - Program crash
  PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3776 -ip 3776
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\teskmgrs.exe

Filesize
89KB

MD5
0ce28d473522a1dc8d607c6b7bc04340

SHA1
791c10809b451a3389d10121e498cdb26743f74f

SHA256
b2001c6fb9e6edfab6bd6bb9775f642db5a50e87b32a5338cd0a2840438a8035

SHA512
61d10b45e2b922ce313260baa4414ebb938416eb53f82c8f864c480ce9d3d9a8c740a101dc8bb242c0cd55e2bc84052611f6e9dd90185be10fdf67c6967d9460

Download Submit
memory/2468-5-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2468-2-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2468-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-25-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-28-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-36-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-17-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-18-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-24-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-35-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-26-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-27-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-34-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-29-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-30-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-31-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-32-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3756-33-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3776-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3776-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/5088-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads