777e5668ddbca7ac83cd060c7d439b77ac2c478d56ea4e54a495f035466b5e8b

General

Target

0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
Size

243KB
MD5

0d3864ad40a03d360c6d8cd3d576683e
SHA1

75c107e3d60e4092fd6b615a306276da2896ee91
SHA256

777e5668ddbca7ac83cd060c7d439b77ac2c478d56ea4e54a495f035466b5e8b
SHA512

f27592b9128ec74f3d7d39d196f08c996dc23a1b4d41407b89442b7fcda2faf4fe66b39d99f51067ce22a9556977ea0bf8471bb4036f924b75d10b9b7fb42b0c
SSDEEP

6144:K0sL59fW/FhMzWxK35o4PGMlYZWe9wz2ZHOSNUknAlsHMT2XlW:K0srfiFlxK35o4PGMEWjzwHnUH+lW

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\0ec659fa\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
2412	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
332	csrss.exe
840	X

Loads dropped DLL 2 IoCs

pid	Process
2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2412	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	31

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{5ceb212f-58f2-2188-4aed-40f0de895d41}	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5ceb212f-58f2-2188-4aed-40f0de895d41}\u = "71"	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5ceb212f-58f2-2188-4aed-40f0de895d41}\cid = "5686187440429505190"	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
840	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
Token: SeDebugPrivilege	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1216	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	21
PID 2240 wrote to memory of 332	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	2
PID 2240 wrote to memory of 840	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	28
PID 2240 wrote to memory of 840	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	28
PID 2240 wrote to memory of 840	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	28
PID 2240 wrote to memory of 840	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	28
PID 840 wrote to memory of 1216	840	X	21
PID 332 wrote to memory of 2668	332	csrss.exe	29
PID 332 wrote to memory of 2668	332	csrss.exe	29
PID 332 wrote to memory of 2560	332	csrss.exe	30
PID 332 wrote to memory of 2560	332	csrss.exe	30
PID 2240 wrote to memory of 2412	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2412	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2412	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2412	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2412	2240	0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe	31

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1216
- C:\Users\Admin\AppData\Local\Temp\0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0d3864ad40a03d360c6d8cd3d576683e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\0ec659fa\X
    *0*47*b1169aa6*69.64.52.10:53
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2412

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2668

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\0ec659fa\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Windows\System32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
6d951e3060a4230faed02de1efbb3633

SHA1
af0ae41a50d315cc2d568e02cde637b99965afd0

SHA256
7c080c5c7017d7a18393a384a8997062fca72d87f060f61ad436359a485fd17c

SHA512
29efa6077e9a2f3ea43d724d7a94971717df3f4846850b380ad689a98e06164e85a434b96eb6b5bd341310d0ebcafc746bf0ff4b5c76d3a89e0fee1682b9168a

Download Submit
memory/332-20-0x0000000000A70000-0x0000000000A7B000-memory.dmp

Filesize
44KB

Download
memory/332-43-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/332-17-0x0000000000A70000-0x0000000000A7B000-memory.dmp

Filesize
44KB

Download
memory/332-19-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1216-32-0x0000000002180000-0x000000000218B000-memory.dmp

Filesize
44KB

Download
memory/1216-11-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/1216-12-0x0000000002150000-0x0000000002152000-memory.dmp

Filesize
8KB

Download
memory/1216-7-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/1216-28-0x0000000002180000-0x000000000218B000-memory.dmp

Filesize
44KB

Download
memory/1216-3-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/1216-37-0x0000000002190000-0x000000000219B000-memory.dmp

Filesize
44KB

Download
memory/1216-36-0x0000000002180000-0x000000000218B000-memory.dmp

Filesize
44KB

Download
memory/1216-39-0x0000000002190000-0x000000000219B000-memory.dmp

Filesize
44KB

Download
memory/1216-38-0x0000000002160000-0x0000000002168000-memory.dmp

Filesize
32KB

Download
memory/1216-47-0x0000000002160000-0x0000000002168000-memory.dmp

Filesize
32KB

Download
memory/2240-2-0x0000000030670000-0x00000000306C6000-memory.dmp

Filesize
344KB

Download
memory/2240-41-0x0000000030670000-0x00000000306A6000-memory.dmp

Filesize
216KB

Download
memory/2240-46-0x0000000030670000-0x00000000306C6000-memory.dmp

Filesize
344KB

Download
memory/2240-45-0x0000000030670000-0x00000000306A6000-memory.dmp

Filesize
216KB

Download
memory/2240-40-0x0000000030670000-0x00000000306C6000-memory.dmp

Filesize
344KB

Download
memory/2240-1-0x0000000030670000-0x00000000306A6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads