d92343d1f2450e19194be54fb4408335fd9acafa34077551c3fa6dfbe216529a

General

Target

5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe
Size

786KB
MD5

5bfd7c62757ae1cb38215b982995696e
SHA1

5ad53acf02ad84ca9b06ff9123380dc1a87f3a49
SHA256

d92343d1f2450e19194be54fb4408335fd9acafa34077551c3fa6dfbe216529a
SHA512

cb4da9495db270210912acbe03b1bc66657ef9093602c10a604a8fa206462bb62524027f878cfb44f6625502d1c4fed35b63cd660c1f90613821f98ac80b186b
SSDEEP

12288:sskmfimeScH68aIG07BnGhCmccj9XikC7QLQqoPZF3Z4mxxfRbW1h8EJ:s9uM1VdnGEmceXiT7QcZZQmXfRi1eO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3700	5.exe
3796	3.exe
3684	KK

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3684 set thread context of 3800	3684	KK	91

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\KK	3.exe
File opened for modification	C:\Windows\KK	3.exe
File created	C:\Windows\UNINSTAL.BAT	3.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1056	3800	WerFault.exe	91
1984	3796	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3796	3.exe
Token: SeDebugPrivilege	3684	KK

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3700	4852	5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe	85
PID 4852 wrote to memory of 3700	4852	5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe	85
PID 4852 wrote to memory of 3700	4852	5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe	85
PID 3700 wrote to memory of 3796	3700	5.exe	86
PID 3700 wrote to memory of 3796	3700	5.exe	86
PID 3700 wrote to memory of 3796	3700	5.exe	86
PID 3684 wrote to memory of 3800	3684	KK	91
PID 3684 wrote to memory of 3800	3684	KK	91
PID 3684 wrote to memory of 3800	3684	KK	91
PID 3684 wrote to memory of 3800	3684	KK	91
PID 3684 wrote to memory of 3800	3684	KK	91
PID 3796 wrote to memory of 816	3796	3.exe	98
PID 3796 wrote to memory of 816	3796	3.exe	98
PID 3796 wrote to memory of 816	3796	3.exe	98

C:\Users\Admin\AppData\Local\Temp\5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5bfd7c62757ae1cb38215b982995696e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 672
      4⤵
      Program crash
      PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
      4⤵
      PID:816

C:\Windows\KK
C:\Windows\KK
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\WINDOWS\SysWOW64\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  2⤵
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 12
    3⤵
    - Program crash
    PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3800 -ip 3800
1⤵
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3796 -ip 3796
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5.exe

Filesize
422KB

MD5
b43990bd747f4c75cddd6f34ca0c734a

SHA1
34798fd8baec03ced9ea3b02d2e3641a2e6f5bc9

SHA256
5fa5e99e30792907c2c7bb71eececd1fccf2836597d5302c6613422e833c12d0

SHA512
df942c6b934d20bc1f4a1f12ff021768f4d1f6a34dde97b9e427c5f2c2e46f2313d6e05691c68b2898b282298a11fdeaf845c2691b478331ffb68f289978c1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3.exe

Filesize
735KB

MD5
845004e9eb891c7d58382f2690629abf

SHA1
dd083a0069b260b29aff4447069037017dcc8c7e

SHA256
64d52f50a621448781db168f2ea3ea732e61c79c3389aae7cf7ec77743ea5a73

SHA512
763afc8922a2b1db571db15faae6ee8e5dc7723edaabe04e55757849234730bf5cc1745ab58ad05c7dfe186e8736824045bcce60597e29864553ff7c8fa5a026

Download Submit
C:\Windows\UNINSTAL.BAT

Filesize
146B

MD5
179c36b93a4d81f1be3cefd74d2993c5

SHA1
1ec8a924a8da6b18002193b3f412044d7bfd9fba

SHA256
3fde54c36920e39225e939eed93cc1c7959dafe6008ae219b9b918faba7a90e2

SHA512
165b92b8383b4eed8291172b39c9841b166560570dad5ebe913f22f46200821fc503db5f0020cce7d7a732b0c7ef84adb45798054cae65e66a5d1ceba0dca58c

Download Submit
memory/3684-33-0x0000000000400000-0x00000000004CD200-memory.dmp

Filesize
820KB

Download
memory/3684-25-0x0000000000400000-0x00000000004CD200-memory.dmp

Filesize
820KB

Download
memory/3700-20-0x0000000001000000-0x00000000010DE000-memory.dmp

Filesize
888KB

Download
memory/3700-29-0x0000000001000000-0x00000000010DE000-memory.dmp

Filesize
888KB

Download
memory/3700-12-0x0000000001000000-0x00000000010DE000-memory.dmp

Filesize
888KB

Download
memory/3796-21-0x0000000000400000-0x00000000004CD200-memory.dmp

Filesize
820KB

Download
memory/3800-24-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4852-3-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-9-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-7-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-0-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-4-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-31-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-2-0x0000000001000000-0x00000000010D3000-memory.dmp

Filesize
844KB

Download
memory/4852-1-0x000000000107C000-0x000000000107D000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads