7566fe668c9cf9b0a92f81279528d141fc7aa4acb3e38c61f3ba4519e88f6981

General

Target

59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
Size

243KB
MD5

59f51a6c348adcf831951ebdb2dfd7db
SHA1

7b82f1fc193392e1d7a97209f1a6cc25678385c7
SHA256

7566fe668c9cf9b0a92f81279528d141fc7aa4acb3e38c61f3ba4519e88f6981
SHA512

3460e69bbf3ff4fe4357719d15e05e2e6037729e731fe7a26de48bfa931f918f56a35adb78c8d84fc9476b42e86959f1283c36981e23edf087bf6e5f59a044cf
SSDEEP

6144:lofAndVrvYwQjRrwuo85fZp+6i4ME1DMmJQu5H4EzDnLVQ:mY7lQjJaCx06TM6MmySHHzDL

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\cb4f2c37\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
2772	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
332	csrss.exe
2780	X

Loads dropped DLL 2 IoCs

pid	Process
2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 2772	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	32

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{9d188ed4-7f0f-50e8-d51f-37567dd51fd0}	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9d188ed4-7f0f-50e8-d51f-37567dd51fd0}\u = "71"	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9d188ed4-7f0f-50e8-d51f-37567dd51fd0}\cid = "2161165983077760765"	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
2780	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
Token: SeDebugPrivilege	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1192	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	21
PID 2408 wrote to memory of 332	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	2
PID 2408 wrote to memory of 2780	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2780	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2780	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2780	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	30
PID 2780 wrote to memory of 1192	2780	X	21
PID 332 wrote to memory of 2268	332	csrss.exe	31
PID 332 wrote to memory of 2268	332	csrss.exe	31
PID 2408 wrote to memory of 2772	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2772	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2772	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2772	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	32
PID 2408 wrote to memory of 2772	2408	59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe	32

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1192
- C:\Users\Admin\AppData\Local\Temp\59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\59f51a6c348adcf831951ebdb2dfd7db_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\cb4f2c37\X
    *0*47*e201fefd*69.64.52.10:53
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2772

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\AppData\Local\cb4f2c37\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
c251f65b09e3dded62a223f24d10ffd4

SHA1
87c63095fa9e44c68882262704d70329a90a9dc7

SHA256
e83039c764c10b89e4c068741424638425e4c059c1b851a47b983b92baa33171

SHA512
9c040b3ef6b08356b5520ed0e33e1bfec075525a92d3082dd5ae74e0dbc8ca0772c736359b062a900efedc452a3889b628cbc910a00e9a1ee0ea107c3c7d09b1

Download Submit
memory/332-19-0x00000000022E0000-0x00000000022EB000-memory.dmp

Filesize
44KB

Download
memory/332-43-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/332-22-0x00000000022E0000-0x00000000022EB000-memory.dmp

Filesize
44KB

Download
memory/332-21-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1192-37-0x00000000025A0000-0x00000000025AB000-memory.dmp

Filesize
44KB

Download
memory/1192-12-0x0000000002560000-0x0000000002562000-memory.dmp

Filesize
8KB

Download
memory/1192-7-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1192-11-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1192-36-0x0000000002590000-0x000000000259B000-memory.dmp

Filesize
44KB

Download
memory/1192-47-0x0000000002570000-0x0000000002578000-memory.dmp

Filesize
32KB

Download
memory/1192-32-0x0000000002590000-0x000000000259B000-memory.dmp

Filesize
44KB

Download
memory/1192-28-0x0000000002590000-0x000000000259B000-memory.dmp

Filesize
44KB

Download
memory/1192-39-0x00000000025A0000-0x00000000025AB000-memory.dmp

Filesize
44KB

Download
memory/1192-38-0x0000000002570000-0x0000000002578000-memory.dmp

Filesize
32KB

Download
memory/1192-3-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/2408-41-0x0000000030670000-0x00000000306A7000-memory.dmp

Filesize
220KB

Download
memory/2408-42-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/2408-40-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/2408-46-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/2408-45-0x0000000030670000-0x00000000306A7000-memory.dmp

Filesize
220KB

Download
memory/2408-2-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/2408-1-0x0000000030670000-0x00000000306A7000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads