a70a36bd91ec5789913fee8983da5e5edfbf1b5854609fa9fb0d80a30fab3fde

General

Target

3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe
Size

912KB
MD5

3233ddeb354b7513eb814477bef54fca
SHA1

f7234caf62f99b42fca21b6011fbffa0475e52f8
SHA256

a70a36bd91ec5789913fee8983da5e5edfbf1b5854609fa9fb0d80a30fab3fde
SHA512

bccb1cc202fa8940c9b90becd435753c806a97199173e14bc538fa442dd505bfe5d364dd69418a69da6fae73e4b02342e74049864e251e6cd24d87edce446200
SSDEEP

24576:SVJuEskQC0HAqIYG3GNjAFjppJ8XLQlB5AjkKJC/ClNk5fpdbs:KFQCV4G3pFrJ8XEtAjkQaIwLo

Score

8^/10

persistence vmprotect

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\jwhpam.dll"	aasd.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\jwhpam.dll"	aasd.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\jwhpam.dll"	aasd.exe

Executes dropped EXE 2 IoCs

pid	Process
2508	aasd.exe
4340	yong.exe

Loads dropped DLL 2 IoCs

pid	Process
2508	aasd.exe
2088	svchost.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x00070000000234bb-20.dat	vmprotect
behavioral2/memory/2508-22-0x0000000010000000-0x00000000100B6000-memory.dmp	vmprotect
behavioral2/memory/2508-25-0x0000000010000000-0x00000000100B6000-memory.dmp	vmprotect
behavioral2/memory/2088-31-0x0000000010000000-0x00000000100B6000-memory.dmp	vmprotect
behavioral2/memory/2088-32-0x0000000010000000-0x00000000100B6000-memory.dmp	vmprotect
behavioral2/memory/2088-37-0x0000000010000000-0x00000000100B6000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jwhpam.dll	aasd.exe
File created	C:\Windows\SysWOW64\0005ccee.sys	aasd.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	aasd.exe
4340	yong.exe
4340	yong.exe
2088	svchost.exe
2088	svchost.exe
2088	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2508	4636	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe	82
PID 4636 wrote to memory of 2508	4636	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe	82
PID 4636 wrote to memory of 2508	4636	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe	82
PID 4636 wrote to memory of 4340	4636	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe	84
PID 4636 wrote to memory of 4340	4636	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe	84
PID 4636 wrote to memory of 4340	4636	3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3233ddeb354b7513eb814477bef54fca_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aasd.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aasd.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yong.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yong.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4340

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k marchi
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aasd.exe

Filesize
433KB

MD5
9942b11053b6bf303a891f430ad84dc7

SHA1
02f2c97c406267e6cc990378f86687c9c5ca281a

SHA256
c5e775d263687bfc438c8a0c4d05b36e9539d81364cdba0306ca2e32eda00d6b

SHA512
770dcb697e1abe7baac4ab0991ddb4685ac426c6eccc15ee248fafb7eb3f423b2c3e30ff2b981cc9b6bdb340aef1a8c9ca56be7b4facbabc4dac3f38463b63f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yong.exe

Filesize
20KB

MD5
82d4d247bfd82e24a33e1025121b065a

SHA1
59a2d5c9a9e8a0ef8d1bf34af9fda10b856137f5

SHA256
61f0343a6b5c5566ed175b450a7e8d15da3635aad9180aa28e412392240a91b5

SHA512
90b7c411eef159df914304b264d9e79d0ecce787a9f7bb87a262bffedf234c94074e27449e42704a5f133489eea1fe18c9a7c0ee18e5c169576ae0777419c32d

Download Submit
C:\Windows\SysWOW64\jwhpam.dll

Filesize
316KB

MD5
9d5abdba76028245a67bc96dda5c6272

SHA1
681772f00a966dead7815199c9e3d42c76a14f1a

SHA256
b3d9d74de1fdea7ac8d1a09b312308cf3adde8b72dcdf15d40881327a2e9e753

SHA512
56d2724cc659246a0d90e3b002f2e75fec2eebc39d4f779df4f7b261d4f81a844e188852204e6e00128b815e776a52c11879b789bbb493efafd96402229f51b5

Download Submit
memory/2088-37-0x0000000010000000-0x00000000100B6000-memory.dmp

Filesize
728KB

Download
memory/2088-32-0x0000000010000000-0x00000000100B6000-memory.dmp

Filesize
728KB

Download
memory/2088-31-0x0000000010000000-0x00000000100B6000-memory.dmp

Filesize
728KB

Download
memory/2508-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2508-25-0x0000000010000000-0x00000000100B6000-memory.dmp

Filesize
728KB

Download
memory/2508-22-0x0000000010000000-0x00000000100B6000-memory.dmp

Filesize
728KB

Download
memory/2508-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2508-18-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2508-16-0x0000000000420000-0x0000000000422000-memory.dmp

Filesize
8KB

Download
memory/2508-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads