da7888d98bd5231810b3c30b957bb442a46a91649df5d6b77b5d09958d83d4f5

General

Target

3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
Size

74KB
MD5

3570e429401a91e49c9f78a63b0dfd30
SHA1

ce704faac303206fcf847fc0eac825871f3f3eac
SHA256

da7888d98bd5231810b3c30b957bb442a46a91649df5d6b77b5d09958d83d4f5
SHA512

e35e3558c7434533e6d37872de997c190219b4b89520cc542b64f48474a8de99b7d18774fc3e408852283952d339938bb7edec43be40295a2216d56851d3675e
SSDEEP

1536:T6CHQGWSGy/p7MocYIlqNxzWX0ITXi/m6eR5D2KdXhsL/H:hHQGWJCMdTlqNxo0mX4m6KDzDszH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	mspprztn.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	mspprztn.exe
File opened (read-only)	\??\M:	mspprztn.exe
File opened (read-only)	\??\N:	mspprztn.exe
File opened (read-only)	\??\U:	mspprztn.exe
File opened (read-only)	\??\W:	mspprztn.exe
File opened (read-only)	\??\H:	mspprztn.exe
File opened (read-only)	\??\Q:	mspprztn.exe
File opened (read-only)	\??\T:	mspprztn.exe
File opened (read-only)	\??\V:	mspprztn.exe
File opened (read-only)	\??\Z:	mspprztn.exe
File opened (read-only)	\??\E:	mspprztn.exe
File opened (read-only)	\??\K:	mspprztn.exe
File opened (read-only)	\??\P:	mspprztn.exe
File opened (read-only)	\??\R:	mspprztn.exe
File opened (read-only)	\??\X:	mspprztn.exe
File opened (read-only)	\??\Y:	mspprztn.exe
File opened (read-only)	\??\B:	mspprztn.exe
File opened (read-only)	\??\G:	mspprztn.exe
File opened (read-only)	\??\J:	mspprztn.exe
File opened (read-only)	\??\L:	mspprztn.exe
File opened (read-only)	\??\O:	mspprztn.exe
File opened (read-only)	\??\S:	mspprztn.exe
File opened (read-only)	\??\A:	mspprztn.exe

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	mspprztn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	mspprztn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\SUPPORT_8712 = "0"	mspprztn.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mspprztn.exe	3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mspprztn.exe	3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mspprztn.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\SUPPORT_8712 = "0"	mspprztn.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	mspprztn.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mspprztn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mspprztn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mspprztn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5316665A-BC2F-4A8F-BE7E-3A52E913654E}\WpadDecision = "0"	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-4c-1b-7a-f0-e2	mspprztn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5316665A-BC2F-4A8F-BE7E-3A52E913654E}\WpadDecisionTime = 80ec7756e3d2da01	mspprztn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5316665A-BC2F-4A8F-BE7E-3A52E913654E}\WpadNetworkName = "Network 3"	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5316665A-BC2F-4A8F-BE7E-3A52E913654E}\ce-4c-1b-7a-f0-e2	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-4c-1b-7a-f0-e2\WpadDecisionReason = "1"	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mspprztn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mspprztn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5316665A-BC2F-4A8F-BE7E-3A52E913654E}\WpadDecisionReason = "1"	mspprztn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-4c-1b-7a-f0-e2\WpadDecisionTime = 80ec7756e3d2da01	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-4c-1b-7a-f0-e2\WpadDecision = "0"	mspprztn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mspprztn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5316665A-BC2F-4A8F-BE7E-3A52E913654E}	mspprztn.exe

C:\Users\Admin\AppData\Local\Temp\3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3570e429401a91e49c9f78a63b0dfd30_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
PID:1888

C:\Windows\SysWOW64\mspprztn.exe
C:\Windows\SysWOW64\mspprztn.exe /service
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Hide Artifacts: Hidden Users
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Users

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mspprztn.exe

Filesize
74KB

MD5
3570e429401a91e49c9f78a63b0dfd30

SHA1
ce704faac303206fcf847fc0eac825871f3f3eac

SHA256
da7888d98bd5231810b3c30b957bb442a46a91649df5d6b77b5d09958d83d4f5

SHA512
e35e3558c7434533e6d37872de997c190219b4b89520cc542b64f48474a8de99b7d18774fc3e408852283952d339938bb7edec43be40295a2216d56851d3675e

Download Submit
memory/1888-1-0x0000000000200000-0x000000000020D000-memory.dmp

Filesize
52KB

Download
memory/1888-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/1888-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1888-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1888-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2412-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads