cc4832edf9468da04a4c2a4a6b5159fb967d7f141a8ebd23dbe83009fc1c4bcd

General

Target

4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Size

52KB
MD5

4b073f817332651c17ccb07a73441a79
SHA1

de23c9af7d75afb196dbdbbd47386d7810e9861d
SHA256

cc4832edf9468da04a4c2a4a6b5159fb967d7f141a8ebd23dbe83009fc1c4bcd
SHA512

ae4bdd9677dab25693c4b6ae543515aea20f44afa57fa6aee9b2d0042e97ed414c648ba43e810caf3ba1677f2ca89588240e8bbc9175255315610f9ed67fd375
SSDEEP

768:e9NHMHPErfe8l6SdK8fHPfekFKB3qaSxQZthxxdeVCech1+Y:0sHPrD8fHf00aSKtPccX+

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000014c65-2.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2776	certmgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1217993601 = "C:\\Windows\\system32\\1217993601\\winlogon.exe"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Logon = "Lg9Fu"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Asynchronous = "0"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Impersonate = "0"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\MaxWait = "258"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\DllName = "C:\\Windows\\system32\\1217993601\\GbN.dll"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ abox\Startup = "Lg9Fu"	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\1217993601\GbN.dll	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1217993601\winlogon.exe	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\1217993601\winlogon.exe	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1217993601\CA.crt	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1217993601\certmgr.exe	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FC1DDBA1A3B19120307637513E4D881BE898480C	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FC1DDBA1A3B19120307637513E4D881BE898480C\Blob = 030000000100000014000000fc1ddba1a3b19120307637513e4d881be898480c2000000001000000bc030000308203b830820321a003020102020900bda753ee4a4293c0300d06092a864886f70d010105050030819a310b3009060355040613024252310b30090603550408130244463111300f0603550407130842726173696c6961311c301a060355040a1313436f6d707574696e6720536f667477617265733111300f060355040b1308496e7465726e6574311430120603550403130b436f6d707574696e6753573124302206092a864886f70d010901161561646d696e40636f6d707574696e6773772e6e6574301e170d3038303430343036343130345a170d3131303430343036343130345a30819a310b3009060355040613024252310b30090603550408130244463111300f0603550407130842726173696c6961311c301a060355040a1313436f6d707574696e6720536f667477617265733111300f060355040b1308496e7465726e6574311430120603550403130b436f6d707574696e6753573124302206092a864886f70d010901161561646d696e40636f6d707574696e6773772e6e657430819f300d06092a864886f70d010101050003818d0030818902818100b0a309fa1aba7b268340afb7da2a6b279081581faeefe6e644e0a59b58d5e0af6316b2f5a4013cf9342e578023fa9a60482a3c74f987909b26702e1863383bf727685af59a0cf1420765416bb88b5459156c7e0312e366b2432ec9d52dbcb19f9836cc85d829087375e17bc78ccafbaeeae6511a4bcea9bad6f301cf3594cc630203010001a38201023081ff301d0603551d0e041604148fe8869320b861f8f7a9c768b474d8c24b736ef73081cf0603551d230481c73081c480148fe8869320b861f8f7a9c768b474d8c24b736ef7a181a0a4819d30819a310b3009060355040613024252310b30090603550408130244463111300f0603550407130842726173696c6961311c301a060355040a1313436f6d707574696e6720536f667477617265733111300f060355040b1308496e7465726e6574311430120603550403130b436f6d707574696e6753573124302206092a864886f70d010901161561646d696e40636f6d707574696e6773772e6e6574820900bda753ee4a4293c0300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002d1bd3df21e951932a2b599d11781e1bd29fda4f141461c3a5d07a0122aae4d3f903f9f7658044d2d319117101f9fa487370fb7b7193474f8bab37574bf0bc1fbe45b4914f314c4caa38829d3968725a918158cec9ff187c82a05f4aa2ec09626aad026cff622c576974acb21da1b8bce39fd59d76b30e5e28ce4d6f9a9285a5	certmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2776	2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2776	2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2776	2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2776	2728	4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b073f817332651c17ccb07a73441a79_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\1217993601\certmgr.exe
  C:\Windows\system32\1217993601\certmgr.exe -add -c CA.crt -s -r localMachine root
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

3

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\1217993601\CA.crt

Filesize
1KB

MD5
499a4c5a719a6fb0e0fe92c2bca3b28f

SHA1
5e1475f2adfeaf283788c7dc3f86a2708ab91d36

SHA256
b23ce371bf9c317349febae34bef615cbc552a7d8df4fbfc1d33b30da72a3f0c

SHA512
b47f4d08b6c5536718349fd2b36a1c851e90db7a97fae214220d4bbd4d7db5455f9edafb76b15323b60ca00a508794980df4faa4081b8c16b72ad70c997cd9d3

Download Submit
\Windows\SysWOW64\1217993601\certmgr.exe

Filesize
28KB

MD5
aa31551fd28444c2fab106f2ab056503

SHA1
46ecfe8ca5ebd3307eeb2b8c36c5d7de331949e4

SHA256
2bb0443af185c99458e43b4e5f60232238ebea72a74d37c31b82ef10ffbc1dc3

SHA512
c6e31185e4d774e22b61665c5fb71493e97a83dc2a9dd853c86ec9ed132beff3bab7601057d4e3bb1527334c3f0e3910b650f831e3a6ab5489f01cb618aaca3c

Download Submit
memory/2728-10-0x0000000000340000-0x0000000000355000-memory.dmp

Filesize
84KB

Download
memory/2728-7-0x0000000000340000-0x0000000000355000-memory.dmp

Filesize
84KB

Download
memory/2728-17-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2776-16-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads