55677536f08d530b196609cce750f0c5dd1acbb3f99014dd628a7889a4484959

General

Target

648c2b317979805c71957cd60b2592d3_JaffaCakes118.exe
Size

260KB
MD5

648c2b317979805c71957cd60b2592d3
SHA1

8e96194f6a1abb1bcdf020dcb5907dbfae46bcee
SHA256

55677536f08d530b196609cce750f0c5dd1acbb3f99014dd628a7889a4484959
SHA512

6ea2c6cb26b15360ff20efc020c7f6f5df06262f2a709cd953da41c28d9f2aee02819164787b35678e884fac4358421d2546ace7c91fcdea70c8e7eb0d689e47
SSDEEP

6144:sVNlOKlzujmQPUbvfxZnQS9/VgPr0UPviGG9R:sGHPULxtY3Pvix9R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	mauxqgy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\0FB9C052 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mauxqgy.exe"	648c2b317979805c71957cd60b2592d3_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	mauxqgy.exe
File opened (read-only)	\??\N:	mauxqgy.exe
File opened (read-only)	\??\Q:	mauxqgy.exe
File opened (read-only)	\??\T:	mauxqgy.exe
File opened (read-only)	\??\B:	mauxqgy.exe
File opened (read-only)	\??\E:	mauxqgy.exe
File opened (read-only)	\??\L:	mauxqgy.exe
File opened (read-only)	\??\O:	mauxqgy.exe
File opened (read-only)	\??\S:	mauxqgy.exe
File opened (read-only)	\??\W:	mauxqgy.exe
File opened (read-only)	\??\X:	mauxqgy.exe
File opened (read-only)	\??\Z:	mauxqgy.exe
File opened (read-only)	\??\G:	mauxqgy.exe
File opened (read-only)	\??\I:	mauxqgy.exe
File opened (read-only)	\??\P:	mauxqgy.exe
File opened (read-only)	\??\U:	mauxqgy.exe
File opened (read-only)	\??\V:	mauxqgy.exe
File opened (read-only)	\??\Y:	mauxqgy.exe
File opened (read-only)	\??\H:	mauxqgy.exe
File opened (read-only)	\??\J:	mauxqgy.exe
File opened (read-only)	\??\K:	mauxqgy.exe
File opened (read-only)	\??\M:	mauxqgy.exe
File opened (read-only)	\??\R:	mauxqgy.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\2D64CB3E = "3931272063"	mauxqgy.exe

C:\Users\Admin\AppData\Local\Temp\648c2b317979805c71957cd60b2592d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\648c2b317979805c71957cd60b2592d3_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
PID:2860

C:\Users\Admin\AppData\Local\Temp\mauxqgy.exe
C:\Users\Admin\AppData\Local\Temp\mauxqgy.exe -svc
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies Internet Explorer settings
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mauxqgy.exe

Filesize
260KB

MD5
648c2b317979805c71957cd60b2592d3

SHA1
8e96194f6a1abb1bcdf020dcb5907dbfae46bcee

SHA256
55677536f08d530b196609cce750f0c5dd1acbb3f99014dd628a7889a4484959

SHA512
6ea2c6cb26b15360ff20efc020c7f6f5df06262f2a709cd953da41c28d9f2aee02819164787b35678e884fac4358421d2546ace7c91fcdea70c8e7eb0d689e47

Download Submit
memory/2852-28-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-25-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-37-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-35-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2852-30-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-26-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-29-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-27-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2852-31-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2860-1-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2860-2-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2860-0-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/2860-34-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2860-33-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2860-12-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2860-11-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads