00af2735bab04fa2265a313fc6237e4093293a724ca14588865a5e569172f89f

General

Target

28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe
Size

898KB
MD5

28e56b3ea9d5ab6bc2924f2dc72689f0
SHA1

4a5c279166c4ad5d39b6d14eac23ec1726ddc387
SHA256

00af2735bab04fa2265a313fc6237e4093293a724ca14588865a5e569172f89f
SHA512

3d81c84e3cf8b3b8f6dca3db1052add606f77d6c4e5c43f2e95ab64764e7ccc03c81343ca6a303d9985ca3c8815cb86ca8bb5bc9204f62c1a57b2f8d52d92afe
SSDEEP

24576:xgmbiorFTnB2HNjEgH9VUP8k+/WMbyaAwXv:+mbiiT4Hl1HaQWMbyaP

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\\\System64.dll"	2VMPPK~1.EXE

Executes dropped EXE 1 IoCs

pid	Process
2408	2VMPPK~1.EXE

Loads dropped DLL 3 IoCs

pid	Process
1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe
1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe
2408	2VMPPK~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64.dll	2VMPPK~1.EXE
File created	C:\Windows\SysWOW64\System64.dat	2VMPPK~1.EXE
File created	C:\Windows\SysWOW64\KMe.bat	2VMPPK~1.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2408	1368	28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe	28
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29
PID 2408 wrote to memory of 2952	2408	2VMPPK~1.EXE	29

C:\Users\Admin\AppData\Local\Temp\28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28e56b3ea9d5ab6bc2924f2dc72689f0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2VMPPK~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2VMPPK~1.EXE
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\system32\KMe.bat
    3⤵
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\KMe.bat

Filesize
73B

MD5
bbff2245a43fc795486d62858b59b4f3

SHA1
518bf49f0f8701db099e1650937a15b62f3d0343

SHA256
8205a4008c6d4ede344abb72b14c1e7067f914405f0295ec8f72842db8c26a44

SHA512
c5caa9ef0858f38cf7a2a7e16f4492cc1bd7f318db15de345f34cf6068b7c66c7aeaafad5f55124723689e8738034755722775800e70e584e5724c7a779aed55

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\2VMPPK~1.EXE

Filesize
843KB

MD5
cbe43826258dd5f9f71fe7c25a1cef3d

SHA1
24f2d1733ee3a7ec0841347069a12ff50fb2eb6c

SHA256
e4503dbdd735585e2c0923f43beceb171466b92dc1ed484f57c57b9390c71636

SHA512
292302c524135f349884a7921090154a6c4a57ef292cf81d5062f8feec3da47e13541abb42f43d9b6812699403e7c88a0ec9cdbccf9b6929311df47e497d7a9b

Download Submit
memory/1368-9-0x0000000000DB0000-0x0000000000E9C000-memory.dmp

Filesize
944KB

Download
memory/1368-8-0x0000000000DB0000-0x0000000000E9C000-memory.dmp

Filesize
944KB

Download
memory/2408-13-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2408-14-0x000000000049A000-0x000000000049B000-memory.dmp

Filesize
4KB

Download
memory/2408-15-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2408-18-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2408-26-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads