499b29009c1d651da0c19d1a5cebd86b7a78a31df88d631f6bc3ce76d9726b3f

General

Target

3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
Size

68KB
MD5

3a7626d876f888a56546cb561740451d
SHA1

97b9f61c482b66460e720fe918df747407babbe0
SHA256

499b29009c1d651da0c19d1a5cebd86b7a78a31df88d631f6bc3ce76d9726b3f
SHA512

c236bf5f4442cc3249f0cd455c01626bb062d2b1e4657a89ce7f5c13103d741e1fb14af827a7e67adce01bed3c1e9a3f9fff74ee625e866fa377c969479f575e
SSDEEP

768:pcbHcXd06GobGyYhvzhc51bmk1IZf+j7PI77jPUpjL26YQxZNJwRLut:YHcXdwhc51bmkGMASL26YQBKut

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Loads dropped DLL 5 IoCs

pid	Process
1532	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
1532	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\vUjcMuwRtxMWrFreGcaDkCnrSrDwPMjFdWSduJeSczuYZGafnd = "C:\\Users\\Admin\\AppData\\Local\\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe"	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3028	1532	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	30
PID 1532 wrote to memory of 3028	1532	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	30
PID 1532 wrote to memory of 3028	1532	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	30
PID 1532 wrote to memory of 3028	1532	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31
PID 3028 wrote to memory of 2772	3028	3a7626d876f888a56546cb561740451d_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Roaming\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Roaming\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\3a7626d876f888a56546cb561740451d_JaffaCakes118.exe

Filesize
68KB

MD5
3a7626d876f888a56546cb561740451d

SHA1
97b9f61c482b66460e720fe918df747407babbe0

SHA256
499b29009c1d651da0c19d1a5cebd86b7a78a31df88d631f6bc3ce76d9726b3f

SHA512
c236bf5f4442cc3249f0cd455c01626bb062d2b1e4657a89ce7f5c13103d741e1fb14af827a7e67adce01bed3c1e9a3f9fff74ee625e866fa377c969479f575e

Download Submit
\Users\Admin\AppData\Roaming\aclui.dll

Filesize
17KB

MD5
e99f74ae594c1b373fa0d34193dce208

SHA1
3933f949724a6702e0038295287a39c53592b11e

SHA256
1dbb3b418bd78abb49d583f2b9cea6b20fe9fece0a59c118ddf104a672e29ebd

SHA512
355a2a3955e0f50b0c41a24589b9283892689faa61aea6360a1b762f5f2f58166c579b37dc0b003e716c1dc760f1931b73faf6fa3e2b21f8571dbdf5ee37c030

Download Submit
memory/1532-1-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1532-2-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/1532-0-0x0000000074B11000-0x0000000074B12000-memory.dmp

Filesize
4KB

Download
memory/1532-28-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/2772-43-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2772-33-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2772-35-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2772-37-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2772-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-45-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2772-49-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2772-50-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3028-27-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/3028-15-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download
memory/3028-46-0x0000000074B10000-0x00000000750BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads