da8f25710645585944814ee946e0e3d5edbc26cb884df830a004ba5ab334d18c

General

Target

475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
Size

477KB
MD5

475f7dc69d7ed1d7a5cb0580d38a2414
SHA1

85614a6aafc44ec95439d89e959fca4a6d3f689c
SHA256

da8f25710645585944814ee946e0e3d5edbc26cb884df830a004ba5ab334d18c
SHA512

daf275dcdacdaa0c377886b978858abbaed3be83a38c0adda5adaa97862dd3c338dc06c6e52d0988f0caebb1aca3701f1a25e304a380093359d9b2de0a1d1b19
SSDEEP

6144:VrmEOwAAnmJU0VJrvOiM0xoy8FGVhbmAQ8aDKykB:lmB7An+/rsd+h6AhaJkB

Score

8^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Universal = "0"	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Universal = "0"	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 1088 wrote to memory of 2468	1088	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	31
PID 2468 wrote to memory of 2848	2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	33
PID 2468 wrote to memory of 2848	2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	33
PID 2468 wrote to memory of 2848	2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	33
PID 2468 wrote to memory of 2848	2468	475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\475f7dc69d7ed1d7a5cb0580d38a2414_JaffaCakes118.exe
  2⤵
  - Drops file in Drivers directory
  - Modifies WinLogon
  - Drops autorun.inf file
  - Hide Artifacts: Hidden Users
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1572
    3⤵
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Users

Modify Registry

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-21-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1088-1-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1088-2-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/1088-0-0x00000000744B1000-0x00000000744B2000-memory.dmp

Filesize
4KB

Download
memory/2468-20-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-22-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-3-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2468-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-23-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-24-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-27-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/2468-38-0x00000000022B0000-0x00000000022F0000-memory.dmp

Filesize
256KB

Download
memory/2848-33-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2848-32-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads