18b6f2fa21221a9de5a62dfa194ed7a8f15fcb7eb42beb618ccd8c1e69d090af

General

Target

2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Size

70KB
MD5

2532c567fc22c68524d1fa9ba2345164
SHA1

7f5b2106c5c1e2a99a05acb6b58f216b37396c7f
SHA256

18b6f2fa21221a9de5a62dfa194ed7a8f15fcb7eb42beb618ccd8c1e69d090af
SHA512

263113fe93c0f77e4ac4795a642c336e36e3b49b7fa10567f78ce3c947d0705f1ca04aa3f4a27f109ad88e09cb7360c97741af135b9e59ed235f04ed9a3b7cac
SSDEEP

1536:R41IOJC/HwmjeFAuHL6B1xVJO6i4HQoe0FB58:i1dqSf0/OYHe

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "kdgvb.exe"	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kdgvb.exe	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\kdgvb.exe	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 4488	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe	87

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeSecurityPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeBackupPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeRestorePrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeShutdownPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeDebugPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeUndockPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: 33	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: 34	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: 35	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
Token: 36	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2556	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe	86
PID 2136 wrote to memory of 2556	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe	86
PID 2136 wrote to memory of 4488	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe	87
PID 2136 wrote to memory of 4488	2136	2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2532c567fc22c68524d1fa9ba2345164_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\bfsvc.exe
  C:\Windows\bfsvc.exe
  2⤵
  PID:2556
- C:\Windows\bfsvc.exe
  C:\Windows\bfsvc.exe
  2⤵
  PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2136-1-0x000000006B800000-0x000000006B8F0000-memory.dmp

Filesize
960KB

Download
memory/2136-16-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads