3bcc16b373418a8c4dc5c612cfd81cf76d9eb023ff3cbbb6d4b571b172ae452a

General

Target

66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe
Size

108KB
MD5

66193f9ff9de6f81921b02d33cb140f6
SHA1

0c287435f1e8eae6f38e9f8e2ce8148521bb2335
SHA256

3bcc16b373418a8c4dc5c612cfd81cf76d9eb023ff3cbbb6d4b571b172ae452a
SHA512

b6e044e875b199e90be0e9b60ecab540b5e176366fec2ef7afe18e16225bab93969e72d22a1979f65af710d4ace651abe99371935f16af28a506de0a7ff25758
SSDEEP

1536:1jpisUVA8Itd42vRxh1FvVzXYiM3A6qNglt8cX4K4s6ODaFCwnKFHSCYMNUz:1NuLItOcdHuATsN6QaMwnLCY6Uz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\P-7-78-8964-9648-3874\wincrs.exe = "C:\\Users\\Admin\\P-7-78-8964-9648-3874\\wincrs.exe:*:Enabled:Microsoft Windows System"	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4400	wincrs.exe
2296	wincrs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows System = "C:\\Users\\Admin\\P-7-78-8964-9648-3874\\wincrs.exe"	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 228 set thread context of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 4400 set thread context of 2296	4400	wincrs.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 228 wrote to memory of 1900	228	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	84
PID 1900 wrote to memory of 4400	1900	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	88
PID 1900 wrote to memory of 4400	1900	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	88
PID 1900 wrote to memory of 4400	1900	66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe	88
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89
PID 4400 wrote to memory of 2296	4400	wincrs.exe	89

C:\Users\Admin\AppData\Local\Temp\66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\66193f9ff9de6f81921b02d33cb140f6_JaffaCakes118.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Users\Admin\P-7-78-8964-9648-3874\wincrs.exe
    "C:\Users\Admin\P-7-78-8964-9648-3874\wincrs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Users\Admin\P-7-78-8964-9648-3874\wincrs.exe
      "C:\Users\Admin\P-7-78-8964-9648-3874\wincrs.exe"
      4⤵
      Executes dropped EXE
      PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\P-7-78-8964-9648-3874\wincrs.exe

Filesize
108KB

MD5
66193f9ff9de6f81921b02d33cb140f6

SHA1
0c287435f1e8eae6f38e9f8e2ce8148521bb2335

SHA256
3bcc16b373418a8c4dc5c612cfd81cf76d9eb023ff3cbbb6d4b571b172ae452a

SHA512
b6e044e875b199e90be0e9b60ecab540b5e176366fec2ef7afe18e16225bab93969e72d22a1979f65af710d4ace651abe99371935f16af28a506de0a7ff25758

Download Submit
memory/228-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/228-2-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/228-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/228-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1900-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1900-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1900-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4400-69-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4400-70-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4400-76-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads