57bfbf59e5f22a6e1392e82631bcb4a4fad5c3baaf694f8669980a393ea02004

General

Target

25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe
Size

28KB
MD5

25f44b616344aa0c4de8d4543d7ec312
SHA1

37362787c8998d6b53f0ac025b9beed21b86774e
SHA256

57bfbf59e5f22a6e1392e82631bcb4a4fad5c3baaf694f8669980a393ea02004
SHA512

aa0332ac67d6fc5d6719cbc5901f0b1fc1aa4c8b4df371de33af2cd8b3e18f6355d77385eab0f23a5a45980c4c6e3820acecc7e58ea7fa832d798de28ebad0ba
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNmfOGgJoqw:Dv8IRRdsxq1DjJcqfDfgJI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1680	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2740-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0038000000014388-8.dat	upx
behavioral1/memory/1680-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2740-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2740-46-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-47-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-57.dat	upx
behavioral1/memory/2740-67-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2740-71-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2740-76-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1680-79-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2740-83-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1680-84-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe
File created	C:\Windows\java.exe	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1680	2740	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe	28
PID 2740 wrote to memory of 1680	2740	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe	28
PID 2740 wrote to memory of 1680	2740	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe	28
PID 2740 wrote to memory of 1680	2740	25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25f44b616344aa0c4de8d4543d7ec312_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp86FB.tmp

Filesize
28KB

MD5
c21aac8aa0913489e89c648833e829e7

SHA1
b107e0a6932f1b662e8ca787d6fdf4779998fc70

SHA256
c209c17907bf0c838443255356fed9d7d9e6426b65d386c1d36b0b3252e40e25

SHA512
b0360d451e53c6a1599220a3b4a28dea3a25deb32e88369d0e923d9eb12026148440cd51cedc35487d184eb9f67c0bf5f3dc43fa991067ffaa4fe5e11d7e1a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8b2ad03c41345ccdf34d5237c557c795

SHA1
6163225073dd686c857535f92a1ec8e677da1d16

SHA256
ba69252833098288d9dc366f76f0a59d1c582ca4a2590003fcd71b126bf2a135

SHA512
91329c4d9bf033ec7c3aa71cae6e331ef24f6cdf0c7944a928bb92b1047e4b308d8871c695b02c78280c76c80c004d11753356f72d84d1d8565ce9baf42fcca3

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1680-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-47-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-79-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1680-84-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2740-46-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-67-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-71-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-76-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2740-83-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads