0dc0e595af5f0af26fa927133d76f9dd4088019ea5f49d7543ef2a4e6ea214b0

General

Target

4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe
Size

55KB
MD5

4340cd3941f841ecef6837b77c7cf8e8
SHA1

78289bd3b503c1922bdeac8c6a808a02dcaab9a2
SHA256

0dc0e595af5f0af26fa927133d76f9dd4088019ea5f49d7543ef2a4e6ea214b0
SHA512

162f0bb0a0702bb50a1a346b6c0ecbe41d2737e2517349a285f1b1632a1196104f3c75a4c5d61f7c085eb02b44cfefbb5a46cb45fd16934fae2fcc5e8364e4d0
SSDEEP

768:qgWbSCv9d/upykGcQU+e268w06TLnP+h52SJ2zNwPkdCEDNnff3GLV:JWtAphvE48w0YLnKQzNwPOGLV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	csrssr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Zvpebfbsg Jvaqbjf Ubfgvat Freivpr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe

Deletes itself 1 IoCs

pid	Process
1676	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2052	csrssr.exe

Loads dropped DLL 2 IoCs

pid	Process
2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe
2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Hosting Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1676	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1676	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1676	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	30
PID 2420 wrote to memory of 1676	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2052	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2052	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2052	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	32
PID 2420 wrote to memory of 2052	2420	4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe	32

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations	csrssr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\DefaultFileTypeRisk = "808464432"	csrssr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes = ".exe"	csrssr.exe

C:\Users\Admin\AppData\Local\Temp\4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4340cd3941f841ecef6837b77c7cf8e8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\del.bat" "
  2⤵
  - Deletes itself
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\csrssr.exe
  "C:\Users\Admin\AppData\Local\Temp\csrssr.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies WinLogon
  - System policy modification
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csrssr.exe

Filesize
55KB

MD5
4340cd3941f841ecef6837b77c7cf8e8

SHA1
78289bd3b503c1922bdeac8c6a808a02dcaab9a2

SHA256
0dc0e595af5f0af26fa927133d76f9dd4088019ea5f49d7543ef2a4e6ea214b0

SHA512
162f0bb0a0702bb50a1a346b6c0ecbe41d2737e2517349a285f1b1632a1196104f3c75a4c5d61f7c085eb02b44cfefbb5a46cb45fd16934fae2fcc5e8364e4d0

Download Submit
C:\del.bat

Filesize
241B

MD5
1b0205bf1e2d062f5ddb7a33853de046

SHA1
827f47e6ac301a0890c6bec3159c3c7d2e63f3c0

SHA256
5076e24de7d0bd7473defafb440a47944e92f98f73a5ee7d2eed64c45d0b2d89

SHA512
e63e3440093fab717b06b55f1f29b43c8c1a04e1c1d17ee96d8a96d09362a1317900d59389ba017b84789ce4c6dde2fd6cf8d139d552ec2d543a8602356036b5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads