9a307fb8f1c1c1bf3255bc8efbedd3e04a809ae0ce8020768c6f752272bd48c4

General

Target

46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
Size

242KB
MD5

46b8cc5f29829b95b10da98da10ab962
SHA1

23dc26396f2ee7d03991e276ce33c06582937ff6
SHA256

9a307fb8f1c1c1bf3255bc8efbedd3e04a809ae0ce8020768c6f752272bd48c4
SHA512

04ba4234a5eb3c698ee346a926ca9accc7e889f6d0c42035b6f1691e8029bf34520e41370f27d408173605333a653e93d5d4fa0efebade0b5edaa619227d82bb
SSDEEP

6144:dIpIaywXBpry94ks/z0tMREk+/o/Q9m5eYjYRhIb:d6MwX3rIgYtMik+Ao9mYnRu

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\0e94107c\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
2604	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
336	csrss.exe
2304	X

Loads dropped DLL 2 IoCs

pid	Process
2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 2604	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	32

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{8b7b1c4f-2775-6e50-2822-c9765af149fd}	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8b7b1c4f-2775-6e50-2822-c9765af149fd}\u = "71"	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8b7b1c4f-2775-6e50-2822-c9765af149fd}\cid = "5577562112606635215"	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
2304	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
Token: SeDebugPrivilege	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1256	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	21
PID 2968 wrote to memory of 336	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	2
PID 2968 wrote to memory of 2304	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2304	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2304	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2304	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	30
PID 2304 wrote to memory of 1256	2304	X	21
PID 336 wrote to memory of 2892	336	csrss.exe	31
PID 336 wrote to memory of 2892	336	csrss.exe	31
PID 2968 wrote to memory of 2604	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2604	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2604	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2604	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2604	2968	46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe	32

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1256
- C:\Users\Admin\AppData\Local\Temp\46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\46b8cc5f29829b95b10da98da10ab962_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\0e94107c\X
    *0*47*b29884cf*69.64.52.10:53
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2604

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\AppData\Local\0e94107c\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
02a7b9085ba235b4d1074250a9a351d6

SHA1
4f550051d95c0048ac4b5dd264216115627b41dd

SHA256
3c42e353e5f42fe7ff2016ba7deb9e652f48a081ffd143266c7e997ce1493667

SHA512
40c091f6fbb3845fbe4f42124eb73b062b6cbd39c1197d7b5bf9954b0d8f6d1c10a15f7fd7279ef2da871c8855fb435b74c0a3f3c177c8e08d4b65156fb9b280

Download Submit
memory/336-19-0x0000000002560000-0x000000000256B000-memory.dmp

Filesize
44KB

Download
memory/336-45-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/336-22-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/336-26-0x0000000002560000-0x000000000256B000-memory.dmp

Filesize
44KB

Download
memory/1256-37-0x0000000002EC0000-0x0000000002ECB000-memory.dmp

Filesize
44KB

Download
memory/1256-11-0x0000000002E80000-0x0000000002E86000-memory.dmp

Filesize
24KB

Download
memory/1256-3-0x0000000002E80000-0x0000000002E86000-memory.dmp

Filesize
24KB

Download
memory/1256-7-0x0000000002E80000-0x0000000002E86000-memory.dmp

Filesize
24KB

Download
memory/1256-38-0x0000000002E80000-0x0000000002E88000-memory.dmp

Filesize
32KB

Download
memory/1256-12-0x0000000002E70000-0x0000000002E72000-memory.dmp

Filesize
8KB

Download
memory/1256-36-0x0000000002EB0000-0x0000000002EBB000-memory.dmp

Filesize
44KB

Download
memory/1256-32-0x0000000002EB0000-0x0000000002EBB000-memory.dmp

Filesize
44KB

Download
memory/1256-28-0x0000000002EB0000-0x0000000002EBB000-memory.dmp

Filesize
44KB

Download
memory/1256-46-0x0000000002E80000-0x0000000002E88000-memory.dmp

Filesize
32KB

Download
memory/1256-47-0x0000000002EC0000-0x0000000002ECB000-memory.dmp

Filesize
44KB

Download
memory/2968-2-0x0000000030670000-0x00000000306C5000-memory.dmp

Filesize
340KB

Download
memory/2968-44-0x0000000030670000-0x00000000306C5000-memory.dmp

Filesize
340KB

Download
memory/2968-43-0x0000000030670000-0x00000000306A6000-memory.dmp

Filesize
216KB

Download
memory/2968-40-0x0000000030670000-0x00000000306A6000-memory.dmp

Filesize
216KB

Download
memory/2968-39-0x0000000030670000-0x00000000306C5000-memory.dmp

Filesize
340KB

Download
memory/2968-1-0x0000000030670000-0x00000000306A6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads