445c5907367d2fa0361d6c403bd6affef5332113a1ef5fab9e7a7e70ce765c8a

General

Target

38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe
Size

356KB
MD5

38ea681aa0cbae184e5427beec08af5f
SHA1

adb753613e6603b146bbd45afe4ac2437af8d369
SHA256

445c5907367d2fa0361d6c403bd6affef5332113a1ef5fab9e7a7e70ce765c8a
SHA512

9e30c74917b382d7487c308c20c39b9a92c4d0bf8ae1dd9198b2e1664a16c888b565dadefc4c85f8a5b9415642b7d812ad06250e84109d8b562f1e1647074740
SSDEEP

6144:7vbx8BMaCOUXupqA5CuPWALLlhhnlB1lJaYlx:7RuBPrLLlhPB1lEY

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2608	5uJH7cEjorg.exe

Executes dropped EXE 2 IoCs

pid	Process
2388	5uJH7cEjorg.exe
2608	5uJH7cEjorg.exe

Loads dropped DLL 5 IoCs

pid	Process
2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe
2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe
2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe
2388	5uJH7cEjorg.exe
2608	5uJH7cEjorg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\XshfoHom = "C:\\ProgramData\\BcfOd4W2rV1KYxm\\5uJH7cEjorg.exe"	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2388 set thread context of 2608	2388	5uJH7cEjorg.exe	32
PID 2608 set thread context of 2568	2608	5uJH7cEjorg.exe	33

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2772	2688	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	30
PID 2772 wrote to memory of 2388	2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	31
PID 2772 wrote to memory of 2388	2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	31
PID 2772 wrote to memory of 2388	2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	31
PID 2772 wrote to memory of 2388	2772	38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe	31
PID 2388 wrote to memory of 2608	2388	5uJH7cEjorg.exe	32
PID 2388 wrote to memory of 2608	2388	5uJH7cEjorg.exe	32
PID 2388 wrote to memory of 2608	2388	5uJH7cEjorg.exe	32
PID 2388 wrote to memory of 2608	2388	5uJH7cEjorg.exe	32
PID 2388 wrote to memory of 2608	2388	5uJH7cEjorg.exe	32
PID 2388 wrote to memory of 2608	2388	5uJH7cEjorg.exe	32
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33
PID 2608 wrote to memory of 2568	2608	5uJH7cEjorg.exe	33

C:\Users\Admin\AppData\Local\Temp\38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\38ea681aa0cbae184e5427beec08af5f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\ProgramData\BcfOd4W2rV1KYxm\5uJH7cEjorg.exe
    "C:\ProgramData\BcfOd4W2rV1KYxm\5uJH7cEjorg.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\ProgramData\BcfOd4W2rV1KYxm\5uJH7cEjorg.exe
      "C:\ProgramData\BcfOd4W2rV1KYxm\5uJH7cEjorg.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe" /i:2608
        5⤵
        
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\BcfOd4W2rV1KYxm\5uJH7cEjorg.exe

Filesize
356KB

MD5
38ea681aa0cbae184e5427beec08af5f

SHA1
adb753613e6603b146bbd45afe4ac2437af8d369

SHA256
445c5907367d2fa0361d6c403bd6affef5332113a1ef5fab9e7a7e70ce765c8a

SHA512
9e30c74917b382d7487c308c20c39b9a92c4d0bf8ae1dd9198b2e1664a16c888b565dadefc4c85f8a5b9415642b7d812ad06250e84109d8b562f1e1647074740

Download Submit
memory/2388-29-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2568-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2568-51-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2568-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-52-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2608-39-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2688-5-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2772-6-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2772-25-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2772-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-4-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2772-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2772-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2772-7-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads