b91a11584996216efb906977b6a7c191997d4256e6f0c9de587eb7fe08f2e7f1

General

Target

60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe
Size

379KB
MD5

60a18a6a3999641ea3876651a6ef9948
SHA1

71d5db3532abd8c76a86f7a1287962bba7797a28
SHA256

b91a11584996216efb906977b6a7c191997d4256e6f0c9de587eb7fe08f2e7f1
SHA512

e834fc92569a03ab894882b06ddb829775a3ec96486c32dd5de6f41e64a517dcbf2c709bf3a0bb5afef33d0a9a685d2ac6a47906e8a0f1cc86aade7e4a60292d
SSDEEP

6144:wlHRB5q1ROcRJvPF+uJtNVhWHGNEg0TqtrdyxAjLV1Yog4UuPMmADssTcg3oSr9:wlx5wJvPF3JtLhAmVLEZ41udoSr

Score

8^/10

execution persistence upx

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-1-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-2-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-3-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-4-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-5-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-6-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-7-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-8-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-9-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-10-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-11-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-12-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-13-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/2036-14-0x0000000000400000-0x000000000051F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\°²È«ÎÀÊ¿Éý¼¶²¹¶¡ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe"	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÎÀÊ¿Éý¼¶Æô¶¯Ïî = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe"	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2404	sc.exe
2536	sc.exe
2384	sc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe
2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2536	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2536	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2536	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2536	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2384	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2384	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2384	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2384	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2404	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2404	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2404	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2404	2036	60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\sc.exe
  sc.exe Create "SDALG" type= own type= interact start= auto DisplayName= "À¹½Ø¶ñÒâÈí¼þ" binPath= "cmd.exe /c start "C:\Users\Admin\AppData\Local\Temp\60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe"
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\SysWOW64\sc.exe
  sc.exe description "SDALG" ¹Ø±Õ´Ë·þÎñ¿ÉÄÜµ¼ÖÂÄ¾ÂíÇ¶Èë
  2⤵
  - Launches sc.exe
  PID:2384
- C:\Windows\SysWOW64\sc.exe
  sc.exe Create "VMnetDHCP" type= own type= interact start= auto DisplayName= "VMware DHCP Service" binPath= "cmd.exe /c start "C:\Users\Admin\AppData\Local\Temp\60a18a6a3999641ea3876651a6ef9948_JaffaCakes118.exe"
  2⤵
  - Launches sc.exe
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-1-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-2-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-3-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-4-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-5-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-6-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-7-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-8-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-9-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-10-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-11-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-12-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-13-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2036-14-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads