c627ab2a1b1d6ec882f8e33972b34530974dc4b953cc347c517db2b924e275f7

General

Target

1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
Size

726KB
MD5

1a203b8b119dc8205871fed951971e7a
SHA1

0ef83882e3e96446b446e0295304b653cb87ca6b
SHA256

c627ab2a1b1d6ec882f8e33972b34530974dc4b953cc347c517db2b924e275f7
SHA512

b566d1b68704701de31ed4e9546c96f60ca38d9bbf81894d64d3653bd70b0e706b3d2d1c1494bd703dc9cfc485b7fb6b87ac6ca902e21a3e2099f7154a46382d
SSDEEP

12288:jXyQ/JBFMheooeChcG4VpuwCWQcUl+gvHZGBMTaN+562HgSJatdUvJjbYXNWB8E9:jiipooeOk31Ul+8HgB+1mQJjiWi1sf

Score

5^/10

Malware Config

Signatures

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\e:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\f:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\g:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\c:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	\??\d:\autorun.inf	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 1176 set thread context of 0	1176	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\Program Files\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\1.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File created	C:\WINDOWS\2.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\2.exe	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1176	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process
PID 1176 wrote to memory of 0	1176	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
PID 1176 wrote to memory of 0	1176	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
PID 1176 wrote to memory of 0	1176	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
PID 1176 wrote to memory of 0	1176	1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a203b8b119dc8205871fed951971e7a_JaffaCakes118.exe"
1⤵
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\1.exe

Filesize
726KB

MD5
1a203b8b119dc8205871fed951971e7a

SHA1
0ef83882e3e96446b446e0295304b653cb87ca6b

SHA256
c627ab2a1b1d6ec882f8e33972b34530974dc4b953cc347c517db2b924e275f7

SHA512
b566d1b68704701de31ed4e9546c96f60ca38d9bbf81894d64d3653bd70b0e706b3d2d1c1494bd703dc9cfc485b7fb6b87ac6ca902e21a3e2099f7154a46382d

Download Submit
memory/1176-15-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-21-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-6-0x0000000000401000-0x00000000004C7000-memory.dmp

Filesize
792KB

Download
memory/1176-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-8-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-10-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-11-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-1-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1176-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-16-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-17-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-43-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-22-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-45-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-44-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1176-47-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1176-49-0x0000000000401000-0x00000000004C7000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads