674eabb427bfdac0e3b12d7d50cc12f31e1957ecee85a256df3de5d9489b8dad

General

Target

14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe
Size

362KB
MD5

14e9c0131dd8fdfbe46852a8bac37d12
SHA1

eadfc77e22ddfd27d02ce880cbd890a3bce09ed9
SHA256

674eabb427bfdac0e3b12d7d50cc12f31e1957ecee85a256df3de5d9489b8dad
SHA512

27480cc0c0a235dbbdf7f9e938c737d8e99060cf71fd3babe452e228014ce46a89e6c96a5a855ab9fcd067092959b1c167f8ac0499ee43d63d500864e78f1348
SSDEEP

6144:S1wPysek7FJO3DFSxEH87s/3koB/eFLot2JUNKSfh1/FXqMsPUu:2wq4FJ4FSwt/ko/e43E0Xrop

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	043A6A5B00014973000BF823B4EB2331.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	043A6A5B00014973000BF823B4EB2331.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\043A6A5B00014973000BF823B4EB2331 = "C:\\ProgramData\\043A6A5B00014973000BF823B4EB2331\\043A6A5B00014973000BF823B4EB2331.exe"	043A6A5B00014973000BF823B4EB2331.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe
2692	043A6A5B00014973000BF823B4EB2331.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe
Token: SeDebugPrivilege	2692	043A6A5B00014973000BF823B4EB2331.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2692	043A6A5B00014973000BF823B4EB2331.exe
2692	043A6A5B00014973000BF823B4EB2331.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2692	043A6A5B00014973000BF823B4EB2331.exe
2692	043A6A5B00014973000BF823B4EB2331.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2692	043A6A5B00014973000BF823B4EB2331.exe
2692	043A6A5B00014973000BF823B4EB2331.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2692	2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe	28
PID 2740 wrote to memory of 2692	2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe	28
PID 2740 wrote to memory of 2692	2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe	28
PID 2740 wrote to memory of 2692	2740	14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\ProgramData\043A6A5B00014973000BF823B4EB2331\043A6A5B00014973000BF823B4EB2331.exe
  "C:\ProgramData\043A6A5B00014973000BF823B4EB2331\043A6A5B00014973000BF823B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\14e9c0131dd8fdfbe46852a8bac37d12_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\043A6A5B00014973000BF823B4EB2331\043A6A5B00014973000BF823B4EB2331.exe

Filesize
362KB

MD5
14e9c0131dd8fdfbe46852a8bac37d12

SHA1
eadfc77e22ddfd27d02ce880cbd890a3bce09ed9

SHA256
674eabb427bfdac0e3b12d7d50cc12f31e1957ecee85a256df3de5d9489b8dad

SHA512
27480cc0c0a235dbbdf7f9e938c737d8e99060cf71fd3babe452e228014ce46a89e6c96a5a855ab9fcd067092959b1c167f8ac0499ee43d63d500864e78f1348

Download Submit
memory/2692-10-0x0000000000950000-0x0000000000A1B000-memory.dmp

Filesize
812KB

Download
memory/2692-30-0x0000000000950000-0x0000000000A1B000-memory.dmp

Filesize
812KB

Download
memory/2692-19-0x0000000000950000-0x0000000000A0C000-memory.dmp

Filesize
752KB

Download
memory/2692-17-0x0000000000950000-0x0000000000A1B000-memory.dmp

Filesize
812KB

Download
memory/2692-9-0x0000000000950000-0x0000000000A0C000-memory.dmp

Filesize
752KB

Download
memory/2740-3-0x0000000001360000-0x000000000142B000-memory.dmp

Filesize
812KB

Download
memory/2740-14-0x0000000001360000-0x000000000142B000-memory.dmp

Filesize
812KB

Download
memory/2740-15-0x0000000001360000-0x000000000142B000-memory.dmp

Filesize
812KB

Download
memory/2740-16-0x0000000001360000-0x000000000141C000-memory.dmp

Filesize
752KB

Download
memory/2740-1-0x00000000001F0000-0x000000000023D000-memory.dmp

Filesize
308KB

Download
memory/2740-2-0x0000000001360000-0x000000000141C000-memory.dmp

Filesize
752KB

Download
memory/2740-0-0x0000000000150000-0x00000000001A7000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads