4ee0463a1369b97f29ba4a65d1dff0a4f804c551ad768fae916051b821dae9fb

General

Target

342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
Size

435KB
MD5

342dff26ac55db2567dec55dd0dce4a0
SHA1

9f8c3aff3faea1d785b4515e98f9e217f0375b58
SHA256

4ee0463a1369b97f29ba4a65d1dff0a4f804c551ad768fae916051b821dae9fb
SHA512

0dfd8723d5eced38f44cd8a88a7dc866c80b3f440f3c7d60ee1ca092f77bae12069e496e7776e023331802b02a9794898482ba4c676e75871516908b198bc54b
SSDEEP

12288:JLgI37qsC/rHyq6ADx09nJenVjP1/y9TTl5D7RIF5TQwRh6:Jb37qsC/jyq6c3mTl5Dmgw

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
740	JGYWvYCLDJ.exe

Loads dropped DLL 3 IoCs

pid	Process
2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
740	JGYWvYCLDJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\JGYWvYCLDJ.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JGYWvYCLDJ.exe"	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
740	JGYWvYCLDJ.exe
740	JGYWvYCLDJ.exe
740	JGYWvYCLDJ.exe
740	JGYWvYCLDJ.exe
740	JGYWvYCLDJ.exe
740	JGYWvYCLDJ.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
740	JGYWvYCLDJ.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
740	JGYWvYCLDJ.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
740	JGYWvYCLDJ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 740	2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe	30
PID 2316 wrote to memory of 740	2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe	30
PID 2316 wrote to memory of 740	2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe	30
PID 2316 wrote to memory of 740	2316	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\342dff26ac55db2567dec55dd0dce4a0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2316
- C:\Users\Admin\AppData\Local\Temp\JGYWvYCLDJ.exe
  "C:\Users\Admin\AppData\Local\Temp\JGYWvYCLDJ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\JGYWvYCLDJ.exe

Filesize
435KB

MD5
342dff26ac55db2567dec55dd0dce4a0

SHA1
9f8c3aff3faea1d785b4515e98f9e217f0375b58

SHA256
4ee0463a1369b97f29ba4a65d1dff0a4f804c551ad768fae916051b821dae9fb

SHA512
0dfd8723d5eced38f44cd8a88a7dc866c80b3f440f3c7d60ee1ca092f77bae12069e496e7776e023331802b02a9794898482ba4c676e75871516908b198bc54b

Download Submit
\Users\Admin\AppData\Local\Temp\TBdDqjGOtj.dll

Filesize
386KB

MD5
504b184f1e617a1b499315eeaaa682b3

SHA1
9fad8722b71210693cdb791bca4d3ba0c0fbf9a0

SHA256
4399f43aca628de75077f91441c1923cbe0eafe7901a227fc4abb53bd8875dfe

SHA512
2680f2a36af2e7f589c42cf9466601633b69451674e0303064d877423fc153120c467c46369c784af7c50ac3d00dc485cb71155da4cb9e8e5131dd823cd4d2bc

Download Submit
memory/740-16-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/740-11-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/740-13-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/740-33-0x0000000010000000-0x000000001012B000-memory.dmp

Filesize
1.2MB

Download
memory/740-47-0x0000000010000000-0x000000001012B000-memory.dmp

Filesize
1.2MB

Download
memory/2316-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2316-0-0x00000000002D0000-0x000000000033A000-memory.dmp

Filesize
424KB

Download
memory/2316-30-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2316-31-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2316-34-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2316-35-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads