36755ad2e2d73260f3cebd70aa55e6d9579ad1c855c4370eb9c10cd4fe404967

General

Target

5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
Size

24KB
MD5

5a23f1bf273620980f14915e8c2d62f0
SHA1

2482a33d4e60f9ca8143b477a05e3f2dd61c3f36
SHA256

36755ad2e2d73260f3cebd70aa55e6d9579ad1c855c4370eb9c10cd4fe404967
SHA512

405cd2bad6d8b57421277d06e4475cf09e07880e33803ee565ee45cf7ccb23dc32e3a55099d65ffc25fc8f1ec323a70aaeb5e593fdcbb12e9641f789d16c4f23
SSDEEP

768:YzO6Ih2gCllQ/9R1PS6j//uom+TdsGXGq:YzM2BURBSSbjTu7q

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,svcser.exe"	svcser.exe

Deletes itself 1 IoCs

pid	Process
2752	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2312	svcser.exe
2036	svcser.exe

Loads dropped DLL 4 IoCs

pid	Process
2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
2312	svcser.exe
2312	svcser.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcser.exe	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svcser.exe	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svcser.exe	svcser.exe
File created	C:\Windows\SysWOW64\svcser.exe	svcser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	svcser.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
2312	svcser.exe
2036	svcser.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2312	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2312	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2312	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2312	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	29
PID 2312 wrote to memory of 2036	2312	svcser.exe	30
PID 2312 wrote to memory of 2036	2312	svcser.exe	30
PID 2312 wrote to memory of 2036	2312	svcser.exe	30
PID 2312 wrote to memory of 2036	2312	svcser.exe	30
PID 2508 wrote to memory of 2752	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2752	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2752	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2752	2508	5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe	31
PID 2752 wrote to memory of 2880	2752	cmd.exe	33
PID 2752 wrote to memory of 2880	2752	cmd.exe	33
PID 2752 wrote to memory of 2880	2752	cmd.exe	33
PID 2752 wrote to memory of 2880	2752	cmd.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2880	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\svcser.exe
  C:\Windows\system32\svcser.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\svcser.exe
    C:\Windows\system32\svcser.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\a.bat" "
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\attrib.exe
    attrib -a -r -s -h 5a23f1bf273620980f14915e8c2d62f0_JaffaCakes118.exe
    3⤵
    - Views/modifies file attributes
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a.bat

Filesize
242B

MD5
70e3bc44459b183fc772ddf0025e4f37

SHA1
9358b1481a891781e485b7d0db597e6c5628585c

SHA256
188cb99afddda3aab8c994101c06cb7f9351b9a0ae5e2267bb2002327c31797f

SHA512
33b4dcbb19f1c18b15d714615eadc88a2166c74c02e3bb6963af9a6c8eebb14f9a1f5feab8a9a8f3870f123d39572a2f9f7a5e0bad7677fb941945d0926073c7

Download Submit
\Windows\SysWOW64\svcser.exe

Filesize
24KB

MD5
5a23f1bf273620980f14915e8c2d62f0

SHA1
2482a33d4e60f9ca8143b477a05e3f2dd61c3f36

SHA256
36755ad2e2d73260f3cebd70aa55e6d9579ad1c855c4370eb9c10cd4fe404967

SHA512
405cd2bad6d8b57421277d06e4475cf09e07880e33803ee565ee45cf7ccb23dc32e3a55099d65ffc25fc8f1ec323a70aaeb5e593fdcbb12e9641f789d16c4f23

Download Submit
memory/2036-31-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2036-27-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2312-18-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2312-26-0x0000000000330000-0x000000000034A000-memory.dmp

Filesize
104KB

Download
memory/2312-43-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2312-44-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2312-45-0x0000000000330000-0x000000000034A000-memory.dmp

Filesize
104KB

Download
memory/2508-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2508-15-0x00000000002D0000-0x00000000002EA000-memory.dmp

Filesize
104KB

Download
memory/2508-14-0x00000000002D0000-0x00000000002EA000-memory.dmp

Filesize
104KB

Download
memory/2508-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2508-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2508-41-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads