7154c47048f484a46afd9c95a9df94bb658c324b9782533d6fffa1d8a79beeda

General

Target

2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
Size

32KB
MD5

2b36fea2cdd01fa70cc97e71c46d397e
SHA1

377693055f8d2ceebb0ba287a5fd2fd5d55f7fe2
SHA256

7154c47048f484a46afd9c95a9df94bb658c324b9782533d6fffa1d8a79beeda
SHA512

31a1408752115f2f772c65a74cfaede3eba82da2ec1a1d51bccd5f4319401c13794f7b84e323fd663eb305caf95854b242c00084c2f9438e3efd6a7828bd4ca6
SSDEEP

384:vWRG4HJzhJORMQ+rqENsUYBr24CxPBkvzat1fYatZ7P/6ZChXtPTUnPla1:F4HJzSKBqoXSrmPB4zat1fYY9hSnP2

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2632	Passepartout.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2820-0-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral1/files/0x000f000000011b9d-8.dat	upx
behavioral1/memory/2820-20-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral1/memory/2820-33-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral1/memory/2632-34-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral1/memory/2632-35-0x0000000000010000-0x0000000000029000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\FASTTRACKPassepartout = "C:\\Windows\\Passepartout.exe -A"	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FASTTRACKPassepartout = "C:\\Windows\\Passepartout.exe -A"	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Passepartout.exe	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://free-default-update-win-mac-free-antivirus-nospam-download.net"	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe
2632	Passepartout.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2632	2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2632	2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2632	2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe	32
PID 2820 wrote to memory of 2632	2820	2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b36fea2cdd01fa70cc97e71c46d397e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Passepartout.exe
  "C:\Windows\Passepartout.exe" -A
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Passepartout.exe

Filesize
32KB

MD5
2b36fea2cdd01fa70cc97e71c46d397e

SHA1
377693055f8d2ceebb0ba287a5fd2fd5d55f7fe2

SHA256
7154c47048f484a46afd9c95a9df94bb658c324b9782533d6fffa1d8a79beeda

SHA512
31a1408752115f2f772c65a74cfaede3eba82da2ec1a1d51bccd5f4319401c13794f7b84e323fd663eb305caf95854b242c00084c2f9438e3efd6a7828bd4ca6

Download Submit
memory/2632-34-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/2632-35-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/2820-16-0x0000000000420000-0x0000000000429000-memory.dmp

Filesize
36KB

Download
memory/2820-18-0x0000000000420000-0x0000000000429000-memory.dmp

Filesize
36KB

Download
memory/2820-17-0x0000000000420000-0x0000000000429000-memory.dmp

Filesize
36KB

Download
memory/2820-0-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/2820-20-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/2820-25-0x0000000003DF0000-0x0000000003E09000-memory.dmp

Filesize
100KB

Download
memory/2820-30-0x0000000003E00000-0x0000000003E19000-memory.dmp

Filesize
100KB

Download
memory/2820-33-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/2820-19-0x0000000000420000-0x0000000000429000-memory.dmp

Filesize
36KB

Download
memory/2820-4-0x0000000000420000-0x0000000000429000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads