682baf6019363b6627b25eb0764b61a2f9a82ff39a0e506274c0a13296b80be0

General

Target

399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe
Size

37KB
MD5

399f0dcb9aa27feb6840b352d037e076
SHA1

c6f71ede19ed7c72155cf116c6ae1917ce669713
SHA256

682baf6019363b6627b25eb0764b61a2f9a82ff39a0e506274c0a13296b80be0
SHA512

774a2647ac235d349b41d5229c60ed6cc8a447eae95c4bf15c3ef29891fd8b6fab4fda0c4b3a0d4ecd7714335a8151b99ce61816e6a3f48b4ac83fc0d599221d
SSDEEP

768:w2RMiIWbg81xG3tAlzfB57yRd+dkz4xWgvNn6tPfbPkT2IOinIBqKuBr:L6wtmL+W4XN6tXbPktIu

Score

10^/10

evasion trojan upx

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	smsc.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smsc.exe

Deletes itself 1 IoCs

pid	Process
3960	smsc.exe

Executes dropped EXE 1 IoCs

pid	Process
3960	smsc.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3244-0-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/files/0x000e00000002349e-3.dat	upx
behavioral2/memory/3244-5-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-9-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-10-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-11-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-12-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-13-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-14-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-16-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-17-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-18-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-19-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-20-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-21-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-22-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3960-23-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smsc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smsc.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	smsc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB	smsc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\smsc.exe	399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe
File opened for modification	C:\Windows\system\smsc.exe	399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	smsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	smsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	smsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	smsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	smsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	smsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	smsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	smsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	smsc.exe

C:\Users\Admin\AppData\Local\Temp\399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\399f0dcb9aa27feb6840b352d037e076_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
PID:3244

C:\Windows\system\smsc.exe
"C:\Windows\system\smsc.exe"
1⤵
- Modifies security service
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\smsc.exe

Filesize
37KB

MD5
399f0dcb9aa27feb6840b352d037e076

SHA1
c6f71ede19ed7c72155cf116c6ae1917ce669713

SHA256
682baf6019363b6627b25eb0764b61a2f9a82ff39a0e506274c0a13296b80be0

SHA512
774a2647ac235d349b41d5229c60ed6cc8a447eae95c4bf15c3ef29891fd8b6fab4fda0c4b3a0d4ecd7714335a8151b99ce61816e6a3f48b4ac83fc0d599221d

Download Submit
memory/3244-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3244-5-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-14-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-17-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-11-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-13-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-9-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-16-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-18-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-19-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-20-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-21-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3960-23-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads