d6fca4b6738a1138354b1c9e107c14e5ad8187e6d3b09cd225e76428aa6e9b9d

General

Target

5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe
Size

61KB
MD5

5f0b95a7781074ae7f890de7e45ae9d2
SHA1

b69c4ee6f795c939ca1358f70259ec0f26535495
SHA256

d6fca4b6738a1138354b1c9e107c14e5ad8187e6d3b09cd225e76428aa6e9b9d
SHA512

32b8f3719a99c91496c3323af14f075c9967649370f1290c689c1d397564a46aff1a0d03dba0c833b8c1aa51877468b0754814f2fd554405418b293ff8df864b
SSDEEP

1536:Kuwn3p9GcmqQ6+YChl6MfrfbBgfErAjPdJ+5q+m5nouy8f:K3n33D4Lf6Mfr9gswPd0s+mpoutf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4144	netprotocol.exe
1348	netprotocol.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4892-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4892-5-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4892-10-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4892-8-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4892-24-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1348-25-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 4144 set thread context of 1348	4144	netprotocol.exe	89

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe
4144	netprotocol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 3908 wrote to memory of 4892	3908	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	86
PID 4892 wrote to memory of 4144	4892	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	88
PID 4892 wrote to memory of 4144	4892	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	88
PID 4892 wrote to memory of 4144	4892	5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe	88
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89
PID 4144 wrote to memory of 1348	4144	netprotocol.exe	89

C:\Users\Admin\AppData\Local\Temp\5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5f0b95a7781074ae7f890de7e45ae9d2_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
61KB

MD5
a70646bd7a5b950f4cacf48242ec6b8c

SHA1
b6851994745aaee795561c98e48ab5ab158355b0

SHA256
4a24801301cbe531f9fa1bb90588eaf6f481ce4160094030e0d84753a716bd07

SHA512
6f0437f1d0b4a3a7e7e29014039bea3cb4edebd935144504fe6b8f4105cbd923f6d2b69874aa31b654665cb1d3db166b525ceafc0c9d74654b4443bfcce4360f

Download Submit
memory/1348-25-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3908-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3908-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4144-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4144-23-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4892-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4892-5-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4892-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4892-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4892-24-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads