32735056e4c33877d44e4859f086186f45d8ad26feee2ead63126e2771c6f83d

General

Target

5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Size

3KB
MD5

5f3b87e01f15e3e0198ee18090b01f3a
SHA1

3a04713f4c6bdfab1d0dba9610905df656b18303
SHA256

32735056e4c33877d44e4859f086186f45d8ad26feee2ead63126e2771c6f83d
SHA512

d883ce9d98c516fe3eae403750c8a0b1054dd8cb454ed0c0d9ffe9479f5bc21609d6d886fa3b478699df027dd3f51f9ff56f34dd99ed5e2a7543e734034c3054

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B0D6265-9E94-4D4F-BB0F-CE609752EACB}\WpadNetworkName = "Network 3"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-11-b1-1d-91-6f\WpadDecisionTime = 504ba56967dada01	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B0D6265-9E94-4D4F-BB0F-CE609752EACB}\WpadDecisionReason = "1"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-11-b1-1d-91-6f	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-11-b1-1d-91-6f\WpadDecisionReason = "1"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B0D6265-9E94-4D4F-BB0F-CE609752EACB}\WpadDecision = "0"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B0D6265-9E94-4D4F-BB0F-CE609752EACB}\ea-11-b1-1d-91-6f	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B0D6265-9E94-4D4F-BB0F-CE609752EACB}\WpadDecisionTime = 504ba56967dada01	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-11-b1-1d-91-6f\WpadDecision = "0"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ba000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7B0D6265-9E94-4D4F-BB0F-CE609752EACB}	5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe"
1⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\5f3b87e01f15e3e0198ee18090b01f3a_JaffaCakes118.exe -A
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2400-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2600-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads