2eae05384145e4972a950c0cec33561c0a4d231d33e6e7b93a6238bd84a6cb5d

General

Target

3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Size

207KB
MD5

3fcdc10dcd82f7278a78a081aafa274c
SHA1

1e72caa387ce0e1e06c236a8855b96c9e14bdb0a
SHA256

2eae05384145e4972a950c0cec33561c0a4d231d33e6e7b93a6238bd84a6cb5d
SHA512

9cd003f45da3edd4e64b02c385e4c536d22b50a059085d804113f8ebf71d8ab6bab87d114a7f3248748101517f04ea589edd872b950e49bcc31b4643bfeb0605
SSDEEP

6144:gTrPN4AfgR0ING/FGdP8LpUCsaXYycPsJ3rIFr2bwrF:gTrPN4yING/FkELds2YrsJnM

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cftmon = "C:\\Windows\\system32\\cftmon.exe"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logoff = "fnGbf2"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Shutdown = "fnGbf2"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Startup = "fnGbf2"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Logon = "fnGbf2"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\StartShell = "fnGbf2"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\DllName = "C:\\Windows\\system32\\mshyta16.dll"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Asynchronous = "0"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A\Impersonate = "0"	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__A	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cftmon.exe	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshyta16.dll	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshyta16.dll	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshdtxt32.dat	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshdtxt32.dat	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
2272	3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fcdc10dcd82f7278a78a081aafa274c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gbf9B65.tmp

Filesize
25KB

MD5
d471b32dcd464e9e7fc14f940d14c4ad

SHA1
e57c539a91521e372fc427b271afe9567641e5d5

SHA256
3c25589f7e5ca3f5201049a45132180fa2ab9b02865705798675f4b7fb803dc1

SHA512
7cb29a6ddaeb11ca696fd13a3cab2b90aecaedb28c3693fb292731610665e77431c2c88f7f3fb0ae976a28a5eda0460e2d8ef6db65efdf368c1e1ebd1129a1c9

Download Submit
memory/2272-0-0x0000000000400000-0x000000000046E2F5-memory.dmp

Filesize
440KB

Download
memory/2272-9-0x0000000000400000-0x000000000046E2F5-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads