bcd39e520d6053518201d3818ca1207de1ad3289abb02ed3fef443e2510e5d9e

General

Target

16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe
Size

28KB
MD5

16429318cda605c8be74d0d866ce7f7a
SHA1

f59704446d564a7a7bb1cbb9deacc53ea3ba4b74
SHA256

bcd39e520d6053518201d3818ca1207de1ad3289abb02ed3fef443e2510e5d9e
SHA512

73ba9acb772f381d8e01db82f50a8069917198b47bb6bca4ec58220b7ae2aae99754f60c39162bd8a397361bc69cdb2c4a9c89c6117461ceeb1df31b63b47ca4
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNpYC4c:Dv8IRRdsxq1DjJcqfm7f

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1444	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2668-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0009000000023515-4.dat	upx
behavioral2/memory/1444-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2668-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1444-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2668-47-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1444-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0008000000023485-58.dat	upx
behavioral2/memory/2668-115-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1444-116-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2668-171-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1444-172-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2668-175-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1444-176-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1444-178-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2668-182-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1444-183-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe
File created	C:\Windows\java.exe	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1444	2668	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe	82
PID 2668 wrote to memory of 1444	2668	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe	82
PID 2668 wrote to memory of 1444	2668	16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16429318cda605c8be74d0d866ce7f7a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB870.tmp

Filesize
28KB

MD5
a8bd248d99e5b314729252cbe5b86c7b

SHA1
a2be02e9c806ea56862b846eae2cb0a10fba495e

SHA256
87ebe942acbcb4739bd4c80c27aed718dad1fbd8dbf1a8e917793ef0548b526d

SHA512
e31ec559c99152313538d915adca1085f0972c6a2ec2892f9a81fc44c7afda74c3af48431672c92848728c7a135bfe0af9571df52dd7103306a47dd4b121b4ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
07a690e83162ce6b052a36fa999f5b24

SHA1
612fc9a794f7cc6e59a78f9e365cc7e8388f4c63

SHA256
750af0f1c29e37797b6da19308ea0e32f534063b184976a058854c4c97f365c7

SHA512
0d4e5382b95d5fd7deb7a6b23edf38930113b96c6289c322c62f659f84392cd0fd4f9c5c8f8ea2e03ec3f76e61b94e503f13a5121d8fdf860aea74c2f0d5d39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f53dd192dac30b2d5de7003ddd07919c

SHA1
ef416011023aff9fb7b385450f8dde727c262d5e

SHA256
8f228728abd2352b090ae91cdb0d90188608f6201edd9e6908f37f00152217c9

SHA512
ed583e647940d951970ab672f98499298bba294eb5c56c92bd4b204e5d899213bd412111a5eb08df83d84a30e35ff3fe0829a89cb4b2a54ac182e971c950fd5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
07f4df7798b1e8272e001810d7df2902

SHA1
d123f351b0baa8654d8e3d5442e3928ddbe754bd

SHA256
b755295a58018897ce7d0ee523f2815105c6586cc9778ff775fd629b5363f6c5

SHA512
58e236eeb6de40414f9cb66a5affd9d5afed602a2be2b51e69f89b7311808332b663ae88206f9418989c5f77356eeb2d15f31c4318f740d8f1bf8ded3f1ba288

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1444-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-172-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-183-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-116-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-178-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2668-47-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2668-175-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2668-171-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2668-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2668-182-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2668-115-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2668-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads