9edc41e8bcccc22fcdf47f6a0158b779cee8df1b75e4bbba9e829efd577939c1

General

Target

3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe
Size

413KB
MD5

3c254ea47ecd003855aec4811d347931
SHA1

9b0769b35e369d8c1ca693eacac0cbbff62c8062
SHA256

9edc41e8bcccc22fcdf47f6a0158b779cee8df1b75e4bbba9e829efd577939c1
SHA512

cf26ef62a280b5a19a2271970c46ad61f8c01b02ace57e092f2f0ff6c813c83a60779dea18a2f234daebd2872335c50427f1393a5bb28b75abcb3109d0b0550c
SSDEEP

6144:scTRLFhpIY/houf4qLAdlwzsT8pdUNhcxckiWZe6YB3W2viZsSQ:9lxhikhoS4qL6iwTayNhcwaSBGZmS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3160	iEiGfKj11500.exe

Loads dropped DLL 2 IoCs

pid	Process
1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe
1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1512-0-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/1512-2-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/1512-5-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/3160-22-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/1512-25-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/3160-26-0x0000000000400000-0x00000000004B2000-memory.dmp	upx
behavioral1/memory/3160-41-0x0000000000400000-0x00000000004B2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\iEiGfKj11500 = "C:\\ProgramData\\iEiGfKj11500\\iEiGfKj11500.exe"	iEiGfKj11500.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iEiGfKj11500.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe
Token: SeDebugPrivilege	3160	iEiGfKj11500.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3160	iEiGfKj11500.exe
3160	iEiGfKj11500.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3160	iEiGfKj11500.exe
3160	iEiGfKj11500.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3160	iEiGfKj11500.exe
3160	iEiGfKj11500.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3160	1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe	30
PID 1512 wrote to memory of 3160	1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe	30
PID 1512 wrote to memory of 3160	1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe	30
PID 1512 wrote to memory of 3160	1512	3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\ProgramData\iEiGfKj11500\iEiGfKj11500.exe
  "C:\ProgramData\iEiGfKj11500\iEiGfKj11500.exe" "C:\Users\Admin\AppData\Local\Temp\3c254ea47ecd003855aec4811d347931_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\iEiGfKj11500\iEiGfKj11500.exe

Filesize
413KB

MD5
d1f9c339d28b2fbd3b81d439f392329d

SHA1
e92ad5637e190b5144788ab86fe4a941d4744a01

SHA256
d7d9a4edcfbecd67c4f64a0f5c9aa236ad1172b3a1a9a6b0f6cc8642d3658b64

SHA512
ce45e4e416d2d50346e937c6d7cff1ffcc12cc404c6d2fe9493b21ca882e3199b82a4e9deabf28301d9531b00d24e950cb87e32d809a3f6ee97afacbd7a7cfe9

Download Submit
memory/1512-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1512-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1512-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1512-5-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1512-4-0x0000000000467000-0x00000000004AF000-memory.dmp

Filesize
288KB

Download
memory/1512-25-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3160-22-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3160-26-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3160-41-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads