66fe97d107a5259718617fc3835dfefb0f31dc8f09c4aa63447da03e9f117c0b

General

Target

83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Size

361KB
MD5

83b830fa3912f1d5dc7b5341a87a5947
SHA1

07e6318258746f508fa182678c27aa5988520f68
SHA256

66fe97d107a5259718617fc3835dfefb0f31dc8f09c4aa63447da03e9f117c0b
SHA512

d05940e124b85b2e45ac7854f91bb661039e6f245c25a605b06a31a9258338a2f4907453c3328ad3fc73b984f70d078bcdbcd5e713f8538fef047c9321f270bd
SSDEEP

6144:wG7rBi2J7TuqnVnD7CdYpr4D3Uxsq1x5oCoeGQ9F5YkaIoBF1JOB:T3BSe7NpcrUxs1CZB9FmkadBNOB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4116	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
4116	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Shutdown = "WinOff2EX"	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Asynchronous = "1"	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Impersonate = "0"	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\DllName = "mdhcp32.dll"	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Startup = "WinStart2EX"	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Logoff = "WinOff2EX"	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shimg.dll	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dll.dll	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\83b830fa3912f1d5dc7b5341a87a5947_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mdhcp32.dll

Filesize
49KB

MD5
73fe7bcf05298a78ce9fbba8516a553e

SHA1
8476bc52094193c75d218610ce75d40c10bc6141

SHA256
ab6f549511196c3f6f3db208a7be04c386de4afc1f63d23453a727434af94812

SHA512
f76a4fe82ef5cf2010d25d0b83e842f71e0fb67b84bc4aba919c7a184201164c2662e2db1b109cc5ddcc752da9189171992ac7ababd328277b2640f85944d28a

Download Submit
memory/4116-6-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/4116-10-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-11-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/4116-12-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-14-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-17-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/4116-16-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-18-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-20-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-22-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-24-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-27-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/4116-26-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-28-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-30-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-32-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-34-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4116-37-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/4116-36-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads