e2b6ee521ee0b25eff01e10c2e5b0f185061cb272f883f8f9e393a6053531fe2

General

Target

4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe
Size

28KB
MD5

4257f23239bc23d9e2dba438d5d325d5
SHA1

acd5a4ddc1b4dda6f90773eca3fa8a54c814e7db
SHA256

e2b6ee521ee0b25eff01e10c2e5b0f185061cb272f883f8f9e393a6053531fe2
SHA512

3d4c15d6dff2ce35a25bbe5c7efedb5294afb1ccb4c1238bc985a890f1555105a73aee1aa31c892d71fb2b88022f86b0c80522798345603e84379e65cac3a0c0
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNGAc:Dv8IRRdsxq1DjJcqfd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2220-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000016d58-7.dat	upx
behavioral1/memory/2968-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2220-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2968-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2220-47-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2968-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000800000001722f-63.dat	upx
behavioral1/memory/2220-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2968-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2220-72-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2968-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2220-77-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2968-78-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-80-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2220-84-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2968-85-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe
File created	C:\Windows\java.exe	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2968	2220	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2968	2220	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2968	2220	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2968	2220	4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4257f23239bc23d9e2dba438d5d325d5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp939A.tmp

Filesize
28KB

MD5
83e4504c64cd5006e7ae9da592afb832

SHA1
098d1817d7b2f704f0198daa19bccacfd7eb3e52

SHA256
fe06857dc7364accd1c908ff41f5954b220b9c2f3be53eb8207bb23d150a4304

SHA512
b925ba9cb85262983a596e25bb400358b83151b54ccbbc01d5a1e1a3dc0af39f28beb0e1f68014568f8b0a50745e2d7dc5cce71e916c00ec195240d69f577cad

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
641061e2b92c8577d52dddcaaa5f7b46

SHA1
75c3af80b06313159620fe9ae10ba429c39907a8

SHA256
8a1ef12e20eb4c02d5c27b03545a8cf407031547247a523d2baf3e72530eb709

SHA512
bd44e28dbbeb4484f40e7df93abf187b45eafa1d3d25f514d304748b4968872fa6e2ac9d894b8caf317f51eccb3f0c9c1e7ac004d25a09c4ce22dab7830f2872

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2220-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2220-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-77-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-72-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2220-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-84-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2220-47-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2968-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-78-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-85-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads