7d9a8bf9d51048f8f88cc61c7cf40425a498e010abb6b2ef5a7df1c1a33489b4

General

Target

259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Size

1.4MB
MD5

259dfb462faa4f73ee20437a8f596c8c
SHA1

56c476669c89145bd18a377e51d25da357c15b2f
SHA256

7d9a8bf9d51048f8f88cc61c7cf40425a498e010abb6b2ef5a7df1c1a33489b4
SHA512

e60a7e3a566c8ea3e7452d723408f5fd63c0e41fc19d9cf4e0d5195b0a43fd90fdd371f59022b9eda4e590f9550f3e3ca60ac9fb65f934c891e73fb77b4580a6
SSDEEP

24576:m/NpLoG5kTuwNZTe9R7RG1qwYwI4qzTzGPJeKx04YoHKlOxU4nM:mjLohCYZTsZ4hqz/7CwOi1

Score

8^/10

evasion persistence themida

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\Locale = "DE"	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\Version = "6,5,5,3"	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\Locale = "DE"	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\Version = "6,5,5,3"	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\ = "poke"	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\StubPath = "C:\\Windows\\system32\\scvhost.exe"	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\ComponentID = "poke"	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\StubPath = "C:\\Windows\\system32\\scvhost.exe"	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\ = "poke"	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}\ComponentID = "poke"	scvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FE06E1AF-D21D-DD3F-C7DF-C070E0C05BBF}	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2708	scvhost.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Wine	scvhost.exe

Loads dropped DLL 4 IoCs

pid	Process
2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
2708	scvhost.exe
2708	scvhost.exe
2708	scvhost.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x00000000006F5000-memory.dmp	themida
behavioral1/files/0x000c000000013a3f-10.dat	themida
behavioral1/memory/2708-22-0x0000000000400000-0x00000000006F5000-memory.dmp	themida
behavioral1/memory/2368-13-0x0000000000400000-0x00000000006F5000-memory.dmp	themida
behavioral1/memory/2708-28-0x0000000000400000-0x00000000006F5000-memory.dmp	themida
behavioral1/memory/2368-30-0x0000000000400000-0x00000000006F5000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\scvhost.exe"	scvhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\scvhost.exe"	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\scvhost.exe	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\scvhost.exe	scvhost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
2708	scvhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2708	scvhost.exe
Token: SeBackupPrivilege	2708	scvhost.exe
Token: SeRestorePrivilege	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
Token: SeBackupPrivilege	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
2708	scvhost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28
PID 2368 wrote to memory of 2708	2368	259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\259dfb462faa4f73ee20437a8f596c8c_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\scvhost.exe
  C:\Windows\system32\scvhost.exe 1
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\scvhost.exe

Filesize
1.4MB

MD5
259dfb462faa4f73ee20437a8f596c8c

SHA1
56c476669c89145bd18a377e51d25da357c15b2f

SHA256
7d9a8bf9d51048f8f88cc61c7cf40425a498e010abb6b2ef5a7df1c1a33489b4

SHA512
e60a7e3a566c8ea3e7452d723408f5fd63c0e41fc19d9cf4e0d5195b0a43fd90fdd371f59022b9eda4e590f9550f3e3ca60ac9fb65f934c891e73fb77b4580a6

Download Submit
memory/2368-0-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2368-1-0x0000000001010000-0x0000000001305000-memory.dmp

Filesize
3.0MB

Download
memory/2368-2-0x00000000025D0000-0x00000000026B3000-memory.dmp

Filesize
908KB

Download
memory/2368-7-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/2368-13-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2368-30-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2708-21-0x0000000000D00000-0x0000000000FF5000-memory.dmp

Filesize
3.0MB

Download
memory/2708-22-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2708-19-0x0000000000D00000-0x0000000000FF5000-memory.dmp

Filesize
3.0MB

Download
memory/2708-20-0x0000000000D00000-0x0000000000FF5000-memory.dmp

Filesize
3.0MB

Download
memory/2708-28-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads