6fc0c57a405f4733aa8118ba8e3afe7b84923b20665228b68cc338dfa0bebc54

General

Target

4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe
Size

28KB
MD5

4dc294b0948b72cc01a1ade3ef063f05
SHA1

f2213543a8ef121cda366eec4f04fa9e47c797dc
SHA256

6fc0c57a405f4733aa8118ba8e3afe7b84923b20665228b68cc338dfa0bebc54
SHA512

6a3cab5f8a039ee7be12aba8f78d0c334d3031f9b6ec6d96251096de45904bcf7f1f6484413456b6c495edc12ac084c6c18d6a856536e5a8c5ec388840b8eb19
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN/gBPIr:Dv8IRRdsxq1DjJcqfwgRIr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3020	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1236-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1236-4-0x00000000001B0000-0x00000000001B8000-memory.dmp	upx
behavioral1/files/0x0007000000018780-9.dat	upx
behavioral1/memory/3020-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1236-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3020-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-47-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1236-51-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3020-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1236-53-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3020-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-59.dat	upx
behavioral1/memory/1236-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3020-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1236-73-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3020-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1236-75-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3020-76-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3020-81-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe
File created	C:\Windows\java.exe	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3020	1236	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe	31
PID 1236 wrote to memory of 3020	1236	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe	31
PID 1236 wrote to memory of 3020	1236	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe	31
PID 1236 wrote to memory of 3020	1236	4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4dc294b0948b72cc01a1ade3ef063f05_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eoqbrO.log

Filesize
1KB

MD5
17cbe8fc6c1e93060fbf9767e73a4c56

SHA1
625ed0b58016ce0957d7671c46bfba41f961b6a1

SHA256
73c5527588c36c050f7907ca1eabd1710367f489bf39a6685985094d7f9e6a1d

SHA512
70f1d6eb48f41feaa44a201488f03dd49386d3f6cb5d7a448466ffeaf5cc3521a3523b7d063878b61d5735e02592862cc1c49eedf4a5df3318fd0b6cd4a26db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp67B8.tmp

Filesize
28KB

MD5
523e7c6622b2b9bb241118d734283172

SHA1
a987d97b153309e3f9db02b3ddbf8e98f009db8a

SHA256
6af6e50054d672391c0a6d96979e7a63e9bb762cbb60087339ad6e4ace0aa94c

SHA512
e35339a2dfea411d35cd9f6e97b1b6713a28ed5e6b2f4b829d33a08f739b9cc914fbb963fed3b20a23a9aff3b1d2980e026fddadeefafaa7d037719030de46c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
a341dd79998e47ae96fd7e01fe030ad7

SHA1
41568c3e0d3bd573c622dd395eb116b73e1cd674

SHA256
03d45b2209b64b785b0974e00ef71ef74c36a33132a10520f5989b39520bd48d

SHA512
f96e0e1cb7d1102b29c55f78e763b039e773e3bc94d80dd8dcad6f7e02a53d817301ae9529fa6aedcfcfe934549603d4ca9e7f67fc0bd9351c9eaf75dc6ce67e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1236-23-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1236-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1236-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1236-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1236-73-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1236-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1236-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1236-51-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1236-75-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3020-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-47-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-81-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-76-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3020-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads