65b1dafdca6026b6267279a0ac327a409f1b9bf8e802f1f3ee0906e2ab0cd598

General

Target

3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
Size

112KB
MD5

3413dfa1fae22e3a618fca32f304b63b
SHA1

636311d413ad9f72da772176e0fca5aae0ae3716
SHA256

65b1dafdca6026b6267279a0ac327a409f1b9bf8e802f1f3ee0906e2ab0cd598
SHA512

7a9b166968e50ff2f5c952f317e6edc502d737107a6037bf61181a706d867d4c5c2a96f64fd50acb9c9a3a31ab54a7668855a99e38699cc1dd62bc1235d3d9d4
SSDEEP

3072:uSathrPGP3s0t85YYC8NT1FqnV6RoQNVm6tVc/bmmaPA:uzthrP+JsYYCsakhNV9QbP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,\\\\?\\globalroot\\systemroot\\system32\\6akd5du.exe,"	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\avgtdix.sys	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\avgtdix.sys	6akd5du.exe

Executes dropped EXE 1 IoCs

pid	Process
2360	6akd5du.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir PersonalEdition Classic	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir PersonalEdition Classic	6akd5du.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
2360	6akd5du.exe
2360	6akd5du.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
Token: SeDebugPrivilege	2360	6akd5du.exe
Token: SeDebugPrivilege	2360	6akd5du.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2360	2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2360	2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2360	2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2360	2356	3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe	30
PID 2360 wrote to memory of 472	2360	6akd5du.exe	6
PID 2360 wrote to memory of 472	2360	6akd5du.exe	6
PID 2360 wrote to memory of 472	2360	6akd5du.exe	6
PID 2360 wrote to memory of 472	2360	6akd5du.exe	6
PID 2360 wrote to memory of 472	2360	6akd5du.exe	6
PID 2360 wrote to memory of 472	2360	6akd5du.exe	6

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:472

C:\Users\Admin\AppData\Local\Temp\3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3413dfa1fae22e3a618fca32f304b63b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- \??\globalroot\systemroot\system32\6akd5du.exe
  \\?\globalroot\systemroot\system32\6akd5du.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Software Discovery

1

T1518

Security Software Discovery

1

T1518.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\6akd5du.exe

Filesize
112KB

MD5
3413dfa1fae22e3a618fca32f304b63b

SHA1
636311d413ad9f72da772176e0fca5aae0ae3716

SHA256
65b1dafdca6026b6267279a0ac327a409f1b9bf8e802f1f3ee0906e2ab0cd598

SHA512
7a9b166968e50ff2f5c952f317e6edc502d737107a6037bf61181a706d867d4c5c2a96f64fd50acb9c9a3a31ab54a7668855a99e38699cc1dd62bc1235d3d9d4

Download Submit
memory/472-10-0x0000000001CD0000-0x0000000001E25000-memory.dmp

Filesize
1.3MB

Download
memory/472-11-0x0000000001CD0000-0x0000000001E25000-memory.dmp

Filesize
1.3MB

Download
memory/472-13-0x0000000001CD0000-0x0000000001E25000-memory.dmp

Filesize
1.3MB

Download
memory/472-15-0x0000000001CD0000-0x0000000001E25000-memory.dmp

Filesize
1.3MB

Download
memory/472-14-0x0000000001CD0000-0x0000000001E25000-memory.dmp

Filesize
1.3MB

Download
memory/2356-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2356-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2360-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads