b358ddcf17067d2de0a909f0cac7fb74d96b7f25cc15cb9f08ad362c5423dfab

General

Target

22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe
Size

274KB
MD5

22d958bc70960f3362513feecfe3ab28
SHA1

0fd519c310e189000bb77ad0b96003285ab0ed9a
SHA256

b358ddcf17067d2de0a909f0cac7fb74d96b7f25cc15cb9f08ad362c5423dfab
SHA512

b97a175c63a544862dd82505484b3a5aa73debbb70f5ad4e0cb901a3a714997e49638cb277c331aaf6ad99acb5bfddd7c863db15bdf1e90d44f95d33a21505d9
SSDEEP

6144:Fx+gnF+2GqK22ee9HaTmS+8QfhNRdw8tRQIWEy/a:Fx+Kw1HaiFtfjweR8J/

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "C:\\Windows\\lsass.exe"	22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lsass.exe	22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe
File opened for modification	C:\Windows\lsass.exe	22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1708	22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe
1708	22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22d958bc70960f3362513feecfe3ab28_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\background_gradient[1]

Filesize
453B

MD5
20f0110ed5e4e0d5384a496e4880139b

SHA1
51f5fc61d8bf19100df0f8aadaa57fcd9c086255

SHA256
1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

SHA512
5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\bullet[1]

Filesize
447B

MD5
26f971d87ca00e23bd2d064524aef838

SHA1
7440beff2f4f8fabc9315608a13bf26cabad27d9

SHA256
1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

SHA512
c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\info_48[1]

Filesize
4KB

MD5
5565250fcc163aa3a79f0b746416ce69

SHA1
b97cc66471fcdee07d0ee36c7fb03f342c231f8f

SHA256
51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

SHA512
e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\navcancl[1]

Filesize
2KB

MD5
4bcfe9f8db04948cddb5e31fe6a7f984

SHA1
42464c70fc16f3f361c2419751acd57d51613cdf

SHA256
bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228

SHA512
bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

Download Submit
memory/1708-6-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-5-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-35-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-44-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-10-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-7-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1708-0-0x0000000000320000-0x0000000000362000-memory.dmp

Filesize
264KB

Download
memory/1708-26-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-4-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-2-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-1-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1708-53-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-61-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1708-70-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads