0e0a6d27fbe14ccd69e2c41a3c2dd9c312181fd7d7aca2117c9ce462e69390ac

General

Target

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe
Size

61KB
MD5

81c4385eb959b53da84e3740c4095048
SHA1

6307f1d13000a4c6f74c838bd253586f95b6e32d
SHA256

0e0a6d27fbe14ccd69e2c41a3c2dd9c312181fd7d7aca2117c9ce462e69390ac
SHA512

788be484c965f1f0cebab4889978b83c616f4121abf784e5820b0e7961851f894d70b94ec19e03bb5f0fe53e6120eecbb979f72e30fed681c4ae4b7cd51422c3
SSDEEP

1536:MBOjity3/7iFw2PnYD57y2+rrQotEZl/n5JuW:4g1/7iFwKn8N+4xhJB

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\sdra64.exe,"	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sdra64.exe	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sdra64.exe	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

pid	process
1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe
1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe
1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe
1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1292 81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe

description	pid	process	target process
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe
PID 1292 wrote to memory of 616	1292	81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe	winlogon.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c4385eb959b53da84e3740c4095048_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-36-0x000000001ED60000-0x000000001ED77000-memory.dmp

Filesize
92KB

Download
memory/616-18-0x000000001ECE0000-0x000000001ECF7000-memory.dmp

Filesize
92KB

Download
memory/616-76-0x000000001EE60000-0x000000001EE77000-memory.dmp

Filesize
92KB

Download
memory/616-12-0x000000001ECC0000-0x000000001ECD7000-memory.dmp

Filesize
92KB

Download
memory/616-41-0x000000001ED80000-0x000000001ED97000-memory.dmp

Filesize
92KB

Download
memory/616-24-0x000000001ED00000-0x000000001ED17000-memory.dmp

Filesize
92KB

Download
memory/616-26-0x000000001ED20000-0x000000001ED37000-memory.dmp

Filesize
92KB

Download
memory/616-46-0x000000001EDA0000-0x000000001EDB7000-memory.dmp

Filesize
92KB

Download
memory/616-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/616-72-0x000000001EE40000-0x000000001EE57000-memory.dmp

Filesize
92KB

Download
memory/616-31-0x000000001ED40000-0x000000001ED57000-memory.dmp

Filesize
92KB

Download
memory/616-51-0x000000001EDC0000-0x000000001EDD7000-memory.dmp

Filesize
92KB

Download
memory/616-56-0x000000001EDE0000-0x000000001EDF7000-memory.dmp

Filesize
92KB

Download
memory/616-61-0x000000001EE00000-0x000000001EE17000-memory.dmp

Filesize
92KB

Download
memory/616-66-0x000000001EE20000-0x000000001EE37000-memory.dmp

Filesize
92KB

Download
memory/1292-0-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/1292-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads