3ed01409e3bdcccc3f5feae5bef042dccfef92fbaeb7b196318e95c4fa852934

General

Target

160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
Size

528KB
MD5

160732c611f3507691eb0d7c16dc04ca
SHA1

9db892b75c2a857bd8e6f8b22f71f3f27f443aec
SHA256

3ed01409e3bdcccc3f5feae5bef042dccfef92fbaeb7b196318e95c4fa852934
SHA512

6b78b8a9216056ce85b674ad2d812f314fa0e9c31af3cf7786bef8713fb56b03e28aac160bf5603b97beab5947b3630d9289f0f90b00a0137a94b600074348d3
SSDEEP

6144:G7puXL6KDkCwPYdoJVnezNxRQ06/0tgSzmHpV6Qc5Gu/GfxQgbW3wRf62d550B5b:6SO7PBVezK06kBmJER5jOf6OTyqrmR

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svc32 = "C:\\Windows\\svc32.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svc32.exe	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
File opened for modification	C:\Windows\svc32.exe	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2680	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2148 wrote to memory of 2400	2148	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	28
PID 2400 wrote to memory of 2680	2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2680	2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2680	2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2680	2400	160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\160732c611f3507691eb0d7c16dc04ca_JaffaCakes118.exe
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v svc32 /t REG_SZ /d C:\Windows\svc32.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-2-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2400-19-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-14-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-20-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-21-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-12-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-10-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-6-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-4-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-22-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2400-26-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads