cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768

General

Target

1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
Size

124KB
MD5

1ab12ca1fb9180ff8fac937066e843a5
SHA1

b01b189363d4c5c25af763abd3b769178ec43abd
SHA256

cb9411230c903f1df0b7d44bed1efe29da8605fdb29d589bdc3fa7d8d74f9768
SHA512

804bd6ad7a3084c42ef3ce13f9de270d8e499d7f530c422bb3a6f822571296ee85700ebd8fda78eb5f2b86bebd641d11b430211cf47e02f2a4514202f94649ed
SSDEEP

3072:KV4nc90YgA4ZKsup/mnU9xw0W/Pgd+vI14:c4nciYg9nUDq/PE4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	regedit.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	regedit.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	regedit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Session Manager Subsystem = "C:\\Windows\\smss.exe"	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Logon Process = "C:\\Windows\\winlogon.exe"	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\disable.reg	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4976	regedit.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4636	3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	90
PID 3092 wrote to memory of 4636	3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	90
PID 3092 wrote to memory of 4636	3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	90
PID 4636 wrote to memory of 1708	4636	net.exe	92
PID 4636 wrote to memory of 1708	4636	net.exe	92
PID 4636 wrote to memory of 1708	4636	net.exe	92
PID 3092 wrote to memory of 4976	3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	93
PID 3092 wrote to memory of 4976	3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	93
PID 3092 wrote to memory of 4976	3092	1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ab12ca1fb9180ff8fac937066e843a5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\net.exe
  net start mswinlogonprocservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start mswinlogonprocservice
    3⤵
    PID:1708
- C:\Windows\SysWOW64\regedit.exe
  regedit -s C:\Windows\disable.reg
  2⤵
  - Modifies firewall policy service
  - Windows security bypass
  - Runs .reg file with regedit
  PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\disable.reg

Filesize
1KB

MD5
95de2ee9e174d0a77debf3280514aed6

SHA1
6f8909c33161711004142e796f7a4f3eba154af1

SHA256
231452b77c342dc4fb3c03c9ae01ae4fb6e118cc9a62b79fe1eab126c7fc8190

SHA512
7f815ee0da6aaa41e084e8df773ec45d108a611f0a726eb7746d4fe7012b7b2a245f57d275258968d5d21dc0c30410eab40fb672c6051eccf3e7c3875c325268

Download Submit
memory/3092-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads