3635eda15ed00987e8d653fbcc2f9feb52556fb414fb0555464cd8601cc742bb

General

Target

6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe
Size

95KB
MD5

6506e7ee00f56492b96b6c6a55291e76
SHA1

93eb2e5d150f9286a8ce8900be4ce15ce01ecc13
SHA256

3635eda15ed00987e8d653fbcc2f9feb52556fb414fb0555464cd8601cc742bb
SHA512

0c2b139158230891a0684f2ef1993c3261457ec644a3c795378dc910d079bf2f94706d8311f056a427cb427d6a737b18ca6478671ef6b9ef3468abef13fe3941
SSDEEP

1536:EuM08IPteBvzchGyDMZqbZ09YhFOhIOOWXls+XQr1QnoJWfbCPHqTlO7r:V8I0NPgIqNSA0aOxboJWfG/qJ0r

Score

8^/10

persistence upx

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll"	4.exe

Executes dropped EXE 1 IoCs

pid	Process
2168	4.exe

Loads dropped DLL 5 IoCs

pid	Process
2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe
2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe
2168	4.exe
2168	4.exe
2932	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2444-34-0x0000000001000000-0x0000000001025006-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll	4.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2168	2444	6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6506e7ee00f56492b96b6c6a55291e76_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\install.tmp

Filesize
50B

MD5
bca35becd9dd601e1d6f8dc0336ad0f7

SHA1
fdc74b2ccede7ad09e64aeec41a8d36c32f8feec

SHA256
d0e5420f5fc76577b271863fb3e52ea089d432a8b2ad6382854cdaf116a6f731

SHA512
d98826054b930027dd6588fd30a83650f6a90d82d4fa0c7b8151258988144ef310ea2fc9584c186ec9ac972ff739650cb18d14518f3985dfb6bb2ecc9436805f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

Filesize
57KB

MD5
e947d05ead80890b951f2c0992601890

SHA1
939dcc5ceb9b59ad29a8f424d6aa74873e9c57e0

SHA256
f292cae5488a0f7f141c8e26e60502f77c5e3ef143e338066089a37b2fdf3618

SHA512
1eb70280f27b514561ff89a30b78a958331af49966261df8cfbfadb52c3cd7e24865e429523cfaa15ac8eb8dd3b4713d63f0e3f3fb91849895b48905c82003e1

Download Submit
\Users\Admin\AppData\Local\Temp\dll.tmp

Filesize
87KB

MD5
7ea420dfd58788368ecb8cd4cee7fa23

SHA1
a379b75f04bfa05fca5ce77afea4142dbe8b8073

SHA256
0043bd7cfa09d90ee96ab0ae302fdb81b2236334a8f781feec159627ca0f3157

SHA512
bcb6b398202563a6e97d213abbbeeef737936032653dd0a4c503ae1b0a83031667c03dc11361806053e948e8e74bf11dd894c9e11cb445a94a73c8c1a5aebaee

Download Submit
memory/2168-15-0x0000000000424000-0x0000000000425000-memory.dmp

Filesize
4KB

Download
memory/2168-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2168-13-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2168-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2168-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2444-12-0x00000000001C0000-0x00000000001F4000-memory.dmp

Filesize
208KB

Download
memory/2444-11-0x00000000001C0000-0x00000000001F4000-memory.dmp

Filesize
208KB

Download
memory/2444-34-0x0000000001000000-0x0000000001025006-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads