5d3c111b411841747fb3f4e8b584253d4d0e04493a7d571a566db85403588c5d

General

Target

47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
Size

14KB
MD5

47a8cbf66d431d55350910a597c72a49
SHA1

85ea98ee6be9bbb32e26d258f7ef6a65c59c85a1
SHA256

5d3c111b411841747fb3f4e8b584253d4d0e04493a7d571a566db85403588c5d
SHA512

1c3b3acaf7fbd8c9d65d58f3d70124829e20362c9a01ed2b4f1b1b541033d6ac7b7a50bed9bb4745a65667faff684bb0ec058b07afadf9511b54a0690101ff18
SSDEEP

384:qyBOLizJwC3nMrnho7XMm0GxsylWXdMeAIAGXO+B:sIwunanh20GxfgdGIB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\tscfgwmijxsj.dll = "{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}"	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2792	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tscfgwmijxsj.tmp	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tscfgwmijxsj.nls	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tscfgwmijxsj.tmp	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}\InProcServer32	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}\InProcServer32\ = "C:\\Windows\\SysWow64\\tscfgwmijxsj.dll"	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}\InProcServer32\ThreadingModel = "Apartment"	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2792	2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2792	2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2792	2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2792	2036	47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47a8cbf66d431d55350910a597c72a49_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\3A90.tmp.bat
  2⤵
  - Deletes itself
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3A90.tmp.bat

Filesize
207B

MD5
a6bbe68071a584cf15daf41f46017fd0

SHA1
1f37da001836f8070f64e2a89e9d7f01c73723d2

SHA256
011ef6b24deb58554f8413df14c5ac20dbde84de42dbf70f0650e562e3b37070

SHA512
855e54afc7a5228de318ada437448af72cafc2edada17ae3dbc8c1074c4a6bcf31a7e57211e13b66e8d9445a4bc0c4f2f3d36f086ad0ad4a272b39f2a5d4e525

Download Submit
C:\Windows\SysWOW64\tscfgwmijxsj.nls

Filesize
428B

MD5
abc2254cf1b9f07e5edf3185d6feb25e

SHA1
51cb11421e4f10bc520196186734056f2414782d

SHA256
900a95dcf36c4579eae17dd842df655f0ab4211991787a3e1ccaf546d4decca2

SHA512
2bd69b0e8b9b1690f1d7ebcf824ecc4c372679e16ad3d7feb1d68c57c9da24727a251a3f8a0824f6b558d62d7e6b44846f210490aa5be4f9b665370d257fcbc3

Download Submit
C:\Windows\SysWOW64\tscfgwmijxsj.tmp

Filesize
2.2MB

MD5
41c92c1d9d5c14226bd80bf2fa65262f

SHA1
e99f0a01d403a114fc17228435d7455c726ffb8d

SHA256
6ec713db095a012920edcbf22c3beb9f869f0bc47786b7e6a80cb195eb387dab

SHA512
e65bfe425625ac9600408b5358390d8d70d6e711e60440a8060b6bfd8f4627b019daae5b42190d49744c55f7153262ee2abc15fe607ab49b8d10d568f15c6e02

Download Submit
memory/2036-16-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2036-25-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads