aed2c28ae943822820d8edf1c47cc4f92746da7ebad167021ee53a3b8791d5c6

General

Target

3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
Size

134KB
MD5

3796dccda5d07130ae9dd41940fce54c
SHA1

2e35da547dda3c31f2062975935b3c09ab7f2a47
SHA256

aed2c28ae943822820d8edf1c47cc4f92746da7ebad167021ee53a3b8791d5c6
SHA512

625cb0d506e9bbe11ad1a72e3e6eba094451b7bc26e3957df706ae23ff7a4362726c6a528679bfb57415ee6c69b28a257d28934d2e8476c18b903141838839a0
SSDEEP

1536:qQ7E4qUpcdWpYKNhPLfcshBFvzFcZ/kANE+:qCE4jmgYKHPLfVDJFc2A3

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2104	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2576-9-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2452-6-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2452-16-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2452-14-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2452-13-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2452-12-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2452-11-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2452-4-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2576-1-0x0000000000320000-0x000000000033F000-memory.dmp	upx
behavioral1/memory/2452-7-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2576-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2452-17-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/files/0x000c00000001866c-28.dat	upx
behavioral1/memory/2452-39-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2104-40-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2104-41-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\S03-7323-GEYNAWT-2623-TGAW\Desktop.ini	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\S03-7323-GEYNAWT-2623-TGAW\Desktop.ini	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2576 wrote to memory of 2452	2576	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	31
PID 2452 wrote to memory of 2104	2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	33
PID 2452 wrote to memory of 2104	2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	33
PID 2452 wrote to memory of 2104	2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	33
PID 2452 wrote to memory of 2104	2452	3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe "C:\Users\Admin\AppData\Local\Temp\3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Roaming\S03-7323-GEYNAWT-2623-TGAW\winlogon.exe
    /del C:\Users\Admin\AppData\Local\Temp\3796dccda5d07130ae9dd41940fce54c_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\S03-7323-GEYNAWT-2623-TGAW\winlogon.exe

Filesize
134KB

MD5
3796dccda5d07130ae9dd41940fce54c

SHA1
2e35da547dda3c31f2062975935b3c09ab7f2a47

SHA256
aed2c28ae943822820d8edf1c47cc4f92746da7ebad167021ee53a3b8791d5c6

SHA512
625cb0d506e9bbe11ad1a72e3e6eba094451b7bc26e3957df706ae23ff7a4362726c6a528679bfb57415ee6c69b28a257d28934d2e8476c18b903141838839a0

Download Submit
memory/2104-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2104-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2452-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-11-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-16-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-39-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-17-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2452-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2576-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2576-1-0x0000000000320000-0x000000000033F000-memory.dmp

Filesize
124KB

Download
memory/2576-9-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing