41dfb7235c9ed749ac8ff6e1e023b8f69282a09786a78e2a44268b3fd75a175c

General

Target
41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe
Size 428KB
Sample240713-pla4aazhmr
SHA256 41dfb7235c9ed749ac8ff6e1e023b8f69282a09786a78e2a44268b3fd75a175c
MD5 41a5a7b5f67fd72c40797bbb299d46b9
SHA1 39131600cdb321070aaad2921237c41950fcd92c
SHA512 c2a20bfc0b26ca621d210bcb81a1fb6ec5ee4a3d9b0dde8df42230f2733a74f07d41dbd03f6fe6a13ae7951d45811290924301d05d0cc3663aafbda2e5085079
SSDEEP 12288:OtyPPTS3rYED+7X2OW8dbDBSlhDcTjYA:rXT1Ey7X2+DuaT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4684	pxador.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts.exe = "C:\\WINDOWS\\msapps\\msinfo\\aprouch\\svchosts.exe"	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxador.exe = "C:\\WINDOWS\\msapps\\msinfo\\aprouch\\pxador.exe"	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts.exe = "C:\\WINDOWS\\msapps\\msinfo\\aprouch\\svchosts.exe"	pxador.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxador.exe = "C:\\WINDOWS\\msapps\\msinfo\\aprouch\\pxador.exe"	pxador.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\msapps\msinfo\aprouch\pxador.exe	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\explo.bat	pxador.exe
File created	C:\WINDOWS\explo.bat	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe
File created	C:\WINDOWS\msapps\msinfo\aprouch\pxador.exe	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2220	reg.exe
3092	reg.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2264	1128	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe	85
PID 1128 wrote to memory of 2264	1128	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe	85
PID 1128 wrote to memory of 2264	1128	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe	85
PID 2264 wrote to memory of 2220	2264	cmd.exe	87
PID 2264 wrote to memory of 2220	2264	cmd.exe	87
PID 2264 wrote to memory of 2220	2264	cmd.exe	87
PID 1128 wrote to memory of 4684	1128	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe	89
PID 1128 wrote to memory of 4684	1128	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe	89
PID 1128 wrote to memory of 4684	1128	41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe	89
PID 4684 wrote to memory of 3484	4684	pxador.exe	90
PID 4684 wrote to memory of 3484	4684	pxador.exe	90
PID 4684 wrote to memory of 3484	4684	pxador.exe	90
PID 3484 wrote to memory of 3092	3484	cmd.exe	92
PID 3484 wrote to memory of 3092	3484	cmd.exe	92
PID 3484 wrote to memory of 3092	3484	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41a5a7b5f67fd72c40797bbb299d46b9_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\explo.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /F
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2220
- C:\WINDOWS\msapps\msinfo\aprouch\pxador.exe
  C:\WINDOWS\msapps\msinfo\aprouch\pxador.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\explo.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /F
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explo.bat

Path C:\WINDOWS\explo.bat
Size 77B
SHA256 f335661fabddf3ecca56756521b02fc9ae3c28952054eb8001dd6563a1c3b70b
MD5 842a5b9784004744843472d6c3440c60
SHA1 a61b7111c76dec741fb98b1eef6e6c45a02e6091
SHA512 89a97e327c595239ba0d4718b09d6bb89a284b030ce32a4d54d8c81a964d13038f1e2107bb19c90a62a90036358cd6ffcd01699b310ebb74905254357fda876b
MD5 SHA1 SHA512

Submit Download

pxador.exe

Path C:\Windows\msapps\msinfo\aprouch\pxador.exe
Size 428KB
SHA256 41dfb7235c9ed749ac8ff6e1e023b8f69282a09786a78e2a44268b3fd75a175c
MD5 41a5a7b5f67fd72c40797bbb299d46b9
SHA1 39131600cdb321070aaad2921237c41950fcd92c
SHA512 c2a20bfc0b26ca621d210bcb81a1fb6ec5ee4a3d9b0dde8df42230f2733a74f07d41dbd03f6fe6a13ae7951d45811290924301d05d0cc3663aafbda2e5085079
SSDEEP 12288:OtyPPTS3rYED+7X2OW8dbDBSlhDcTjYA:rXT1Ey7X2+DuaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1128-0-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/1128-12-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4684-8-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/4684-13-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4684-15-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/4684-21-0x0000000000400000-0x0000000000471000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads