82aa61051443f06cc3ca09f8d0048b38d1647548c483c0e00f0869dbe1407fa9

General

Target

3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe
Size

111KB
MD5

3487df4a0ad369b67e4858de8576a5bb
SHA1

3b32c1749aeb3b04c87bf0e7b1a9517c7d59b7d7
SHA256

82aa61051443f06cc3ca09f8d0048b38d1647548c483c0e00f0869dbe1407fa9
SHA512

b4498c14767ba3ceaa1acb3be79351ec8fd3c9da3a6a825ca09f7eda5c6b4e77ca028555c565a41fbf1905d112b53c0d91a5d4ec401130752249d3960e08ef1f
SSDEEP

1536:xjx8Xi4oEWXeFT7ThMQbowZV3EIv1MO3d/YUwrrD60wbpsdlwD2fCevwUG:BYi1EGeFHTRblN3dUO0wbpsdlhfCOnG

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 1 IoCs

pid	Process
2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winguis.dll	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winguis.dll	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe
2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 256	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	1
PID 2016 wrote to memory of 336	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	2
PID 2016 wrote to memory of 384	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	3
PID 2016 wrote to memory of 392	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	4
PID 2016 wrote to memory of 424	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	5
PID 2016 wrote to memory of 480	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	6
PID 2016 wrote to memory of 488	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	7
PID 2016 wrote to memory of 496	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	8
PID 2016 wrote to memory of 596	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	9
PID 2016 wrote to memory of 672	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	10
PID 2016 wrote to memory of 740	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	11
PID 2016 wrote to memory of 808	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	12
PID 2016 wrote to memory of 844	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	13
PID 2016 wrote to memory of 960	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	15
PID 2016 wrote to memory of 280	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	16
PID 2016 wrote to memory of 1008	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	17
PID 2016 wrote to memory of 1060	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	18
PID 2016 wrote to memory of 1100	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	19
PID 2016 wrote to memory of 1160	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	20
PID 2016 wrote to memory of 1200	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	21
PID 2016 wrote to memory of 1712	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	23
PID 2016 wrote to memory of 1032	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	24
PID 2016 wrote to memory of 1860	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	25
PID 2016 wrote to memory of 2448	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	26
PID 2016 wrote to memory of 788	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	27
PID 2016 wrote to memory of 1820	2016	3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe	29

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1712
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1860
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:740
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1160
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:960
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:280
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1100
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1032
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2448
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:788
- - C:\Users\Admin\AppData\Local\Temp\3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2016
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3487df4a0ad369b67e4858de8576a5bb_JaffaCakes118.exe"
  2⤵
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\winguis.dll

Filesize
88KB

MD5
afa7c064c6ed4d233806d6be2480a212

SHA1
358b8cf957cd011b0043a275220d3e0dd1685440

SHA256
7a224cd3db6a42c15126c01d69f5b8521b9b2e03d16942d16161cf46dc4485a3

SHA512
a7ccaae07034ea59d95bd96ad5fa3efe89fd35d59d7353b08e344a1417a752b44dc2ee244c6c25b418326d58ad0f0e2e5677a9901165a3735303dbc50ddc55fd

Download Submit
memory/256-6-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1820-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1820-47-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2016-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2016-10-0x00000000769D4000-0x00000000769D5000-memory.dmp

Filesize
4KB

Download
memory/2016-46-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing