cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768

General

Target

1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
Size

124KB
MD5

1ab12ca1fb9180ff8fac937066e843a5
SHA1

b01b189363d4c5c25af763abd3b769178ec43abd
SHA256

cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768
SHA512

804bd6ad7a3084c42ef3ce13f9de270d8e499d7f530c422bb3a6f822571296ee85700ebd8fda78eb5f2b86bebd641d11b430211cf47e02f2a4514202f94649ed
SSDEEP

3072:KV4nc90YgA4ZKsup/mnU9xw0W/Pgd+vI14:c4nciYg9nUDq/PE4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 13 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	regedit.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	regedit.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts	regedit.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	regedit.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	regedit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Session Manager Subsystem = "C:\\Windows\\smss.exe"	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Logon Process = "C:\\Windows\\winlogon.exe"	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\disable.reg	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2944	regedit.exe
532	regedit.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2516	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2516	AUDIODG.EXE
Token: 33	2516	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2516	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2480	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	30
PID 2236 wrote to memory of 2480	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	30
PID 2236 wrote to memory of 2480	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	30
PID 2236 wrote to memory of 2480	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	30
PID 2480 wrote to memory of 2948	2480	net.exe	33
PID 2480 wrote to memory of 2948	2480	net.exe	33
PID 2480 wrote to memory of 2948	2480	net.exe	33
PID 2480 wrote to memory of 2948	2480	net.exe	33
PID 2236 wrote to memory of 2944	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	34
PID 2236 wrote to memory of 2944	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	34
PID 2236 wrote to memory of 2944	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	34
PID 2236 wrote to memory of 2944	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	34
PID 2236 wrote to memory of 2680	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	35
PID 2236 wrote to memory of 2680	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	35
PID 2236 wrote to memory of 2680	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	35
PID 2236 wrote to memory of 2680	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	35
PID 2236 wrote to memory of 532	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	37
PID 2236 wrote to memory of 532	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	37
PID 2236 wrote to memory of 532	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	37
PID 2236 wrote to memory of 532	2236	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	37
PID 2680 wrote to memory of 324	2680	net.exe	38
PID 2680 wrote to memory of 324	2680	net.exe	38
PID 2680 wrote to memory of 324	2680	net.exe	38
PID 2680 wrote to memory of 324	2680	net.exe	38

C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\net.exe
  net start mswinlogonprocservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start mswinlogonprocservice
    3⤵
    PID:2948
- C:\Windows\SysWOW64\regedit.exe
  regedit -s C:\Windows\disable.reg
  2⤵
  - Modifies firewall policy service
  - Windows security bypass
  - Runs .reg file with regedit
  PID:2944
- C:\Windows\SysWOW64\net.exe
  net start mswinlogonprocservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start mswinlogonprocservice
    3⤵
    PID:324
- C:\Windows\SysWOW64\regedit.exe
  regedit -s C:\Windows\disable.reg
  2⤵
  - Modifies firewall policy service
  - Windows security bypass
  - Runs .reg file with regedit
  PID:532

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x530
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\disable.reg

Filesize
1KB

MD5
95de2ee9e174d0a77debf3280514aed6

SHA1
6f8909c33161711004142e796f7a4f3eba154af1

SHA256
231452b77c342dc4fb3c03c9ae01ae4fb6e118cc9a62b79fe1eab126c7fc8190

SHA512
7f815ee0da6aaa41e084e8df773ec45d108a611f0a726eb7746d4fe7012b7b2a245f57d275258968d5d21dc0c30410eab40fb672c6051eccf3e7c3875c325268

Download Submit
memory/2236-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2236-9-0x0000000004FA0000-0x00000000052E7000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads