8aa400113a2ca3cb3bcd3102adaa4ae96885f7304a5a819402a32ce71356b982

General

Target

253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe
Size

58KB
MD5

253e55763838aa7eadb36a1490c86ad0
SHA1

e86ce7d2fb75c5664c1b53974f66b7f4dfc43bbe
SHA256

8aa400113a2ca3cb3bcd3102adaa4ae96885f7304a5a819402a32ce71356b982
SHA512

fbfb6536110fe1e1b6ac5dac1757bd5695b6f4698ede79f9be749d296d48c4a5c27823593b3f70b3963ca044ba320bf7111a879a036146407e8ae961853dbe50
SSDEEP

1536:jOKrXpzV9obOREBaKhRvtAEdpJkLqgQQP:J7bREFBWopJkLqgQQP

Score

8^/10

persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{YS78P12D-PA2C-45YS-SW12-WUDZ24FPO90Z}	gldrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{YS78P12D-PA2C-45YS-SW12-WUDZ24FPO90Z}\StubPath = "C:\\Windows\\SysWOW64\\gldrv.exe"	gldrv.exe

Deletes itself 1 IoCs

pid	Process
1852	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
4856	gldrv.exe
1852	svchost.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5108-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/files/0x0007000000023423-7.dat	upx
behavioral2/memory/5108-19-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/4856-20-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-21-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-22-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-23-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-24-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-25-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-26-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-27-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-28-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-29-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-30-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-31-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-32-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-33-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/1852-34-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gldrv.exe	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gldrv.Exe	gldrv.exe
File created	C:\Windows\SysWOW64\gldrv.exe	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.Exe	svchost.exe
File created	C:\Windows\svchost.exe	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5108	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe
4856	gldrv.exe
1852	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4856	5108	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe	81
PID 5108 wrote to memory of 4856	5108	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe	81
PID 5108 wrote to memory of 4856	5108	253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe	81
PID 4856 wrote to memory of 1852	4856	gldrv.exe	82
PID 4856 wrote to memory of 1852	4856	gldrv.exe	82
PID 4856 wrote to memory of 1852	4856	gldrv.exe	82

C:\Users\Admin\AppData\Local\Temp\253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\253e55763838aa7eadb36a1490c86ad0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\gldrv.exe
  C:\Windows\System32\gldrv.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
58KB

MD5
253e55763838aa7eadb36a1490c86ad0

SHA1
e86ce7d2fb75c5664c1b53974f66b7f4dfc43bbe

SHA256
8aa400113a2ca3cb3bcd3102adaa4ae96885f7304a5a819402a32ce71356b982

SHA512
fbfb6536110fe1e1b6ac5dac1757bd5695b6f4698ede79f9be749d296d48c4a5c27823593b3f70b3963ca044ba320bf7111a879a036146407e8ae961853dbe50

Download Submit
memory/1852-25-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-27-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-34-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-21-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-22-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-23-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-24-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-33-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-26-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-29-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-30-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1852-31-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4856-20-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5108-19-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5108-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads