2fa69fe2e4d854fe0ec292104fb48c1937960e0d0a3285ff491c2e00b675237a

General

Target

3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Size

74KB
MD5

3f52edfd7cbf419e71e38b517b823ec7
SHA1

46ee85f269542bcaa35352c770c3411e41a96668
SHA256

2fa69fe2e4d854fe0ec292104fb48c1937960e0d0a3285ff491c2e00b675237a
SHA512

f110ba7af0e20b783e8472ec9f0a0b98ad793ed31f624b771ea50638241b53e04b34f2af19a081b27f0eb78dc1a82035ef67089888e4509d681f22ffc899f625
SSDEEP

1536:gjy3vj6vlkFgJM3SEE+DvQhfaZ/+fk15q:gjy3vj6vlX+Sm/+fk15q

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cisvc = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\cisvc.exe /waitservice"	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv = "C:\\Windows\\System32\\drivers\\clipsrv.exe /waitservice"	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\clipsrv.exe	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3052	cisvc.exe

Loads dropped DLL 2 IoCs

pid	Process
1336	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
1336	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System\mstinit.exe	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
File created	C:\Windows\System\cisvc.exe	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
File created	C:\Windows\System\cisvc.exe	cisvc.exe
File created	C:\Windows\mstsc.exe	cisvc.exe
File opened for modification	C:\Windows\mstsc.exe	cisvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MstInit = "C:\\Windows\\System\\mstinit.exe /waitservice"	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3052	1336	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe	31
PID 1336 wrote to memory of 3052	1336	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe	31
PID 1336 wrote to memory of 3052	1336	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe	31
PID 1336 wrote to memory of 3052	1336	3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f52edfd7cbf419e71e38b517b823ec7_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\System\cisvc.exe
  C:\Windows\System\cisvc.exe /waitservice
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\mstinit.exe

Filesize
74KB

MD5
3f52edfd7cbf419e71e38b517b823ec7

SHA1
46ee85f269542bcaa35352c770c3411e41a96668

SHA256
2fa69fe2e4d854fe0ec292104fb48c1937960e0d0a3285ff491c2e00b675237a

SHA512
f110ba7af0e20b783e8472ec9f0a0b98ad793ed31f624b771ea50638241b53e04b34f2af19a081b27f0eb78dc1a82035ef67089888e4509d681f22ffc899f625

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads