52815313fca13b1472dd85aeafb20f0a008af23fa2e894e6bfe55da656de84a3

General

Target

30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe
Size

639KB
MD5

30dde2d0e8ceec4ca9ff68663dd61da4
SHA1

309469847d00d826359c8fc0bd29c017682757ac
SHA256

52815313fca13b1472dd85aeafb20f0a008af23fa2e894e6bfe55da656de84a3
SHA512

bfe9b7046d706355987965c624b70be854ab048f92edfd6b51572bbe8da9bd1dd34b243a4d46109b58b16273b80a7b870b2d0378e29df906eef0d54a3b885d34
SSDEEP

12288:yZXDVdJ91Zj23JE5lUgSdKb/36F3Z4mxxVCexZrZ0O/BnBr1rY:yZXp7rZiE5lfSsjKQmXVCsGMRp1Y

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4992	a1g.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\a1g.exe	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe
File created	C:\Windows\a1g.exe	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	a1g.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	a1g.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	a1g.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	a1g.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	a1g.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe
Token: SeDebugPrivilege	4992	a1g.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	a1g.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4060	4224	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe	80
PID 4224 wrote to memory of 4060	4224	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe	80
PID 4224 wrote to memory of 4060	4224	30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30dde2d0e8ceec4ca9ff68663dd61da4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4060

C:\Windows\a1g.exe
C:\Windows\a1g.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\a1g.exe

Filesize
639KB

MD5
30dde2d0e8ceec4ca9ff68663dd61da4

SHA1
309469847d00d826359c8fc0bd29c017682757ac

SHA256
52815313fca13b1472dd85aeafb20f0a008af23fa2e894e6bfe55da656de84a3

SHA512
bfe9b7046d706355987965c624b70be854ab048f92edfd6b51572bbe8da9bd1dd34b243a4d46109b58b16273b80a7b870b2d0378e29df906eef0d54a3b885d34

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
b074e87bf6249f0b6319637c4cb523ee

SHA1
7c185b83cdda978b9f7654b566d28a1f8057b5bc

SHA256
bda73d873b89a2524f1a44affcd69c2c0750d384f807decd60709b6057a8d40a

SHA512
567129e4f5fe1a08dffadc709c80eac1d6e3ba0940ff337b894adb415b892225ac399d9da333e49582a12b32ce12ec404e98e863a126313c6a12baadce09812e

Download Submit
memory/4224-20-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4224-17-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4224-7-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4224-6-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4224-5-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/4224-4-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4224-3-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/4224-2-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/4224-18-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4224-25-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4224-24-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4224-23-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4224-22-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4224-21-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4224-8-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4224-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4224-26-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/4224-19-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4224-16-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4224-15-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4224-14-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4224-13-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4224-12-0x00000000034C0000-0x00000000034C3000-memory.dmp

Filesize
12KB

Download
memory/4224-11-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4224-10-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4224-28-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/4224-27-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/4224-9-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4224-35-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4224-36-0x0000000002380000-0x00000000023D4000-memory.dmp

Filesize
336KB

Download
memory/4224-1-0x0000000002380000-0x00000000023D4000-memory.dmp

Filesize
336KB

Download
memory/4992-38-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing