42a63fe99861ed6bb09167730a383db9b4c2e829bd0e122d662648b0bfa5dddc

General

Target

4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
Size

144KB
MD5

4a6e402b32e9aa511971fe9fed794e3d
SHA1

d0a06b802a768cef53420db8d2cac5fe89394839
SHA256

42a63fe99861ed6bb09167730a383db9b4c2e829bd0e122d662648b0bfa5dddc
SHA512

42c42c7aa850818227f0eaa61aefd800691274999fcca40a68bf38449a7391ba63f735a1f1776ecf20276aae026c962295a235e3ec792eb0c217a7a933f7628a
SSDEEP

3072:tv/q95gcctBXqO7Gdxl2430X8+xWyiXWVGb6awiM7b:w+6zf24A8+xidLwBb

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

Jtyuyd.exeJtyuyd.exe

pid process

4532 Jtyuyd.exe
1932 Jtyuyd.exe

pid	process
4532	Jtyuyd.exe
1932	Jtyuyd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jtyuyd = "C:\\Users\\Admin\\AppData\\Roaming\\Jtyuyd.exe"	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exeJtyuyd.exe

description	pid	process	target process
PID 2344 set thread context of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 4532 set thread context of 1932	4532	Jtyuyd.exe	Jtyuyd.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31119059"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427825670"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2583172918"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2583172918"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119059"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C59814C2-42C6-11EF-BE68-D63901C91A66} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2585673380"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31119059"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe

pid process

3328 4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
3328 4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Jtyuyd.exeIEXPLORE.EXE

description pid process

Token: SeDebugPrivilege 1932 Jtyuyd.exe
Token: SeDebugPrivilege 2940 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

220 IEXPLORE.EXE

pid	process
3328	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
3328	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1932	Jtyuyd.exe
Token: SeDebugPrivilege	2940	IEXPLORE.EXE

pid	process
220	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exeJtyuyd.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
4532	Jtyuyd.exe
220	IEXPLORE.EXE
220	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exeJtyuyd.exeJtyuyd.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 2344 wrote to memory of 3328	2344	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
PID 3328 wrote to memory of 4532	3328	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	Jtyuyd.exe
PID 3328 wrote to memory of 4532	3328	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	Jtyuyd.exe
PID 3328 wrote to memory of 4532	3328	4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 4532 wrote to memory of 1932	4532	Jtyuyd.exe	Jtyuyd.exe
PID 1932 wrote to memory of 184	1932	Jtyuyd.exe	iexplore.exe
PID 1932 wrote to memory of 184	1932	Jtyuyd.exe	iexplore.exe
PID 1932 wrote to memory of 184	1932	Jtyuyd.exe	iexplore.exe
PID 184 wrote to memory of 220	184	iexplore.exe	IEXPLORE.EXE
PID 184 wrote to memory of 220	184	iexplore.exe	IEXPLORE.EXE
PID 220 wrote to memory of 2940	220	IEXPLORE.EXE	IEXPLORE.EXE
PID 220 wrote to memory of 2940	220	IEXPLORE.EXE	IEXPLORE.EXE
PID 220 wrote to memory of 2940	220	IEXPLORE.EXE	IEXPLORE.EXE
PID 1932 wrote to memory of 2940	1932	Jtyuyd.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 2940	1932	Jtyuyd.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\4a6e402b32e9aa511971fe9fed794e3d_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Users\Admin\AppData\Roaming\Jtyuyd.exe
    "C:\Users\Admin\AppData\Roaming\Jtyuyd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Roaming\Jtyuyd.exe
      C:\Users\Admin\AppData\Roaming\Jtyuyd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:184
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:220 CREDAT:17410 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A4F1OTIC\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\Jtyuyd.exe

Filesize
144KB

MD5
4a6e402b32e9aa511971fe9fed794e3d

SHA1
d0a06b802a768cef53420db8d2cac5fe89394839

SHA256
42a63fe99861ed6bb09167730a383db9b4c2e829bd0e122d662648b0bfa5dddc

SHA512
42c42c7aa850818227f0eaa61aefd800691274999fcca40a68bf38449a7391ba63f735a1f1776ecf20276aae026c962295a235e3ec792eb0c217a7a933f7628a

Download Submit
memory/1932-19-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1932-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1932-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3328-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3328-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3328-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3328-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads