3258001bd74ab68825ac5c7d6ceeadb6fc4a1737704fa28227a0b0a250270d93

General

Target

16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
Size

13KB
MD5

16c1f3a171bca17a2afb429a451afb1d
SHA1

b93d6bd21483baba6ba0f121bb31f3c1a460f24a
SHA256

3258001bd74ab68825ac5c7d6ceeadb6fc4a1737704fa28227a0b0a250270d93
SHA512

f487ea923f195ecfb06b60f0e000f1f7dab5c4db9c47cd9a6cf833814695a1fbaffb3cabb7798e52413be9366e384579e3934e47ad353a3490e8512c42037a77
SSDEEP

192:nmOr1W7LByeduaOkAG6+mkAuLe/LJwlfeTSBaXZQmV/le8ZSwMFd3oCd7a7vtyB8:nma1F4t6Vpu+yMpV/lLSwsGg7EqXX4CG

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\dispexcb.dll = "{76D44356-B494-443a-BEDC-AA68DE4255E6}"	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dispexcb.tmp	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dispexcb.tmp	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dispexcb.nls	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D44356-B494-443a-BEDC-AA68DE4255E6}\InProcServer32\ = "C:\\Windows\\SysWow64\\dispexcb.dll"	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D44356-B494-443a-BEDC-AA68DE4255E6}\InProcServer32\ThreadingModel = "Apartment"	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D44356-B494-443a-BEDC-AA68DE4255E6}	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D44356-B494-443a-BEDC-AA68DE4255E6}\InProcServer32	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 832	4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe	100
PID 4784 wrote to memory of 832	4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe	100
PID 4784 wrote to memory of 832	4784	16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16c1f3a171bca17a2afb429a451afb1d_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\7AD8.tmp.bat
  2⤵
  PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7AD8.tmp.bat

Filesize
207B

MD5
c89ba20bdc8ee59ba9ab41c16b9ca773

SHA1
7982179d2e58acffc4f1fe4dc2b42b32db68dc23

SHA256
0cabb62f4855fb969f9afc4fa24dff045fa2311ffa516a76042f19b7811faab5

SHA512
aa645188d92026c4deb086651177dfde2f7e5ec9ebeff838cd313a700242a49f7615356d048f37c65eb84ebbb4322ff71138204151b1a10d348b19b197a49d27

Download Submit
C:\Windows\SysWOW64\dispexcb.nls

Filesize
428B

MD5
258053b380bc93b614c32a18b8b726ea

SHA1
0f04967ba3a6226368623155838d51711e3e0a8c

SHA256
2ab1145482d8d09e90d8d0e2b5f4ff2532eb89ba7f71587ee15a9dd7138e18ef

SHA512
71146acb2f4ad59df738d49749908af7f87a28c3aa970f61f48786bbabafae4b9f3c8e85ec9d51e517aa2dca1bc276db66d49b90823690f67a19164b23f8f2eb

Download Submit
C:\Windows\SysWOW64\dispexcb.tmp

Filesize
975KB

MD5
e424265c8e07eb9c0a4a1d1259ab013c

SHA1
7c741a9b8d2c1c0880394584b9c6bd990bf32d65

SHA256
36635038f2c81f0f8a9b5ed47d59052c9f1fc70ac6f9c91af55413f1db99d583

SHA512
a6b4da2631bfaf38ee75d62608e04a8049c617370f82c27d2fd798e3a14cedd1ab435c0cd5083e155a328304e67fb94bbc98b65c495f9158428df0442b14255e

Download Submit
memory/4784-17-0x0000000020000000-0x000000002006C000-memory.dmp

Filesize
432KB

Download
memory/4784-22-0x0000000020000000-0x000000002006C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads