60f5607fa56e160eeb38486242d7bfed4b41546a82cc720a422e29eeb1dc10f0

General

Target

4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe
Size

659KB
MD5

4a202a97a94b7aaac097fd7c8b38523d
SHA1

a3d97ce6b448abdf1ea6e5c0107b7722a4dec7be
SHA256

60f5607fa56e160eeb38486242d7bfed4b41546a82cc720a422e29eeb1dc10f0
SHA512

b173d69dfce23493fff9927107295a3ea013897911dd214ae1060f32016cb319c51bf1c26538576fe801eff20216a853e6488b314b5ae2129cb866b0f00dc9c0
SSDEEP

12288:8HbeOUe5UMJI8kx2mgUwoz5bubi02VViLksY2ixG9MFPk0FhMg:8HbBUMRs8Uwoz5bM2VVEOzxCMFPkoL

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\AmericanG.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AmericanG.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\crypted.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crypted.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

crypted.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\6dj6jdjddjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AmericanG.exe"	crypted.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

crypted.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4C3B1FB-EECB-CDBB-A0AC-2EBE80FA8C1B}	crypted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4C3B1FB-EECB-CDBB-A0AC-2EBE80FA8C1B}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AmericanG.exe"	crypted.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B4C3B1FB-EECB-CDBB-A0AC-2EBE80FA8C1B}	crypted.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B4C3B1FB-EECB-CDBB-A0AC-2EBE80FA8C1B}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AmericanG.exe"	crypted.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

crypted.exe

pid process

3448 crypted.exe

pid	process
3448	crypted.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

crypted.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6dj6jdjddjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AmericanG.exe"	crypted.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6dj6jdjddjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AmericanG.exe"	crypted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

5068 reg.exe
1360 reg.exe
4016 reg.exe
4248 reg.exe

pid	process
5068	reg.exe
1360	reg.exe
4016	reg.exe
4248	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

crypted.exe

description	pid	process
Token: 1	3448	crypted.exe
Token: SeCreateTokenPrivilege	3448	crypted.exe
Token: SeAssignPrimaryTokenPrivilege	3448	crypted.exe
Token: SeLockMemoryPrivilege	3448	crypted.exe
Token: SeIncreaseQuotaPrivilege	3448	crypted.exe
Token: SeMachineAccountPrivilege	3448	crypted.exe
Token: SeTcbPrivilege	3448	crypted.exe
Token: SeSecurityPrivilege	3448	crypted.exe
Token: SeTakeOwnershipPrivilege	3448	crypted.exe
Token: SeLoadDriverPrivilege	3448	crypted.exe
Token: SeSystemProfilePrivilege	3448	crypted.exe
Token: SeSystemtimePrivilege	3448	crypted.exe
Token: SeProfSingleProcessPrivilege	3448	crypted.exe
Token: SeIncBasePriorityPrivilege	3448	crypted.exe
Token: SeCreatePagefilePrivilege	3448	crypted.exe
Token: SeCreatePermanentPrivilege	3448	crypted.exe
Token: SeBackupPrivilege	3448	crypted.exe
Token: SeRestorePrivilege	3448	crypted.exe
Token: SeShutdownPrivilege	3448	crypted.exe
Token: SeDebugPrivilege	3448	crypted.exe
Token: SeAuditPrivilege	3448	crypted.exe
Token: SeSystemEnvironmentPrivilege	3448	crypted.exe
Token: SeChangeNotifyPrivilege	3448	crypted.exe
Token: SeRemoteShutdownPrivilege	3448	crypted.exe
Token: SeUndockPrivilege	3448	crypted.exe
Token: SeSyncAgentPrivilege	3448	crypted.exe
Token: SeEnableDelegationPrivilege	3448	crypted.exe
Token: SeManageVolumePrivilege	3448	crypted.exe
Token: SeImpersonatePrivilege	3448	crypted.exe
Token: SeCreateGlobalPrivilege	3448	crypted.exe
Token: 31	3448	crypted.exe
Token: 32	3448	crypted.exe
Token: 33	3448	crypted.exe
Token: 34	3448	crypted.exe
Token: 35	3448	crypted.exe
Token: SeDebugPrivilege	3448	crypted.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

crypted.exe

pid process

3448 crypted.exe
3448 crypted.exe
3448 crypted.exe

pid	process
3448	crypted.exe
3448	crypted.exe
3448	crypted.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.execrypted.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 64 wrote to memory of 3448	64	4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe	crypted.exe
PID 64 wrote to memory of 3448	64	4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe	crypted.exe
PID 64 wrote to memory of 3448	64	4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe	crypted.exe
PID 3448 wrote to memory of 3276	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3276	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3276	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3192	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3192	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3192	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3452	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3452	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 3452	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 4508	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 4508	3448	crypted.exe	cmd.exe
PID 3448 wrote to memory of 4508	3448	crypted.exe	cmd.exe
PID 3192 wrote to memory of 4248	3192	cmd.exe	reg.exe
PID 3192 wrote to memory of 4248	3192	cmd.exe	reg.exe
PID 3192 wrote to memory of 4248	3192	cmd.exe	reg.exe
PID 3276 wrote to memory of 1360	3276	cmd.exe	reg.exe
PID 3276 wrote to memory of 1360	3276	cmd.exe	reg.exe
PID 3276 wrote to memory of 1360	3276	cmd.exe	reg.exe
PID 4508 wrote to memory of 5068	4508	cmd.exe	reg.exe
PID 4508 wrote to memory of 5068	4508	cmd.exe	reg.exe
PID 4508 wrote to memory of 5068	4508	cmd.exe	reg.exe
PID 3452 wrote to memory of 4016	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4016	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4016	3452	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a202a97a94b7aaac097fd7c8b38523d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:64

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3276

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1360

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\crypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\crypted.exe:*:Enabled:Windows Messanger" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\crypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\crypted.exe:*:Enabled:Windows Messanger" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4248

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4016

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\AmericanG.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AmericanG.exe:*:Enabled:Windows Messanger" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\AmericanG.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AmericanG.exe:*:Enabled:Windows Messanger" /f
4⤵
- Modifies firewall policy service
- Modifies registry key
PID:5068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Active Setup

1

T1547.014

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

5

T1112

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\crypted.exe
Filesize
420KB

MD5
0422aac2bcf8471112ad5d5023bfab44

SHA1
b3cd954c89ad4d505040956c2385fa19b244c280

SHA256
9d889436b92cc6a7843c585a764700dac7a3473c497af1dfeba9faae6be9ea01

SHA512
54c437837881ade72721ead55791a39adfed4b77ffa8c73ac34157df1b746d966d34fc48be7bd775e427ab059c4f53a985a9f4e16b1df54f82938d66d9f559ef

Download Submit
memory/64-8-0x00007FFED7840000-0x00007FFED81E1000-memory.dmp

Filesize
9.6MB

Download
memory/64-4-0x000000001BF90000-0x000000001C45E000-memory.dmp

Filesize
4.8MB

Download
memory/64-9-0x00007FFED7840000-0x00007FFED81E1000-memory.dmp

Filesize
9.6MB

Download
memory/64-5-0x000000001C500000-0x000000001C59C000-memory.dmp

Filesize
624KB

Download
memory/64-1-0x000000001B8E0000-0x000000001B986000-memory.dmp

Filesize
664KB

Download
memory/64-6-0x00000000014D0000-0x00000000014D8000-memory.dmp

Filesize
32KB

Download
memory/64-7-0x000000001C5D0000-0x000000001C61C000-memory.dmp

Filesize
304KB

Download
memory/64-30-0x00007FFED7AF5000-0x00007FFED7AF6000-memory.dmp

Filesize
4KB

Download
memory/64-3-0x00007FFED7840000-0x00007FFED81E1000-memory.dmp

Filesize
9.6MB

Download
memory/64-2-0x00007FFED7840000-0x00007FFED81E1000-memory.dmp

Filesize
9.6MB

Download
memory/64-0-0x00007FFED7AF5000-0x00007FFED7AF6000-memory.dmp

Filesize
4KB

Download
memory/64-29-0x00007FFED7840000-0x00007FFED81E1000-memory.dmp

Filesize
9.6MB

Download
memory/3448-24-0x00000000752F1000-0x00000000752F2000-memory.dmp

Filesize
4KB

Download
memory/3448-26-0x00000000752D0000-0x00000000753C0000-memory.dmp

Filesize
960KB

Download
memory/3448-25-0x00000000752D0000-0x00000000753C0000-memory.dmp

Filesize
960KB

Download
memory/3448-33-0x00000000752D0000-0x00000000753C0000-memory.dmp

Filesize
960KB

Download
memory/3448-34-0x00000000752D0000-0x00000000753C0000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads