960603e1605112d14f16bdbf904b4784bee023b5f4ccb333d0b962a0da0b4875

General

Target

8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
Size

221KB
MD5

8c12387bb2a41646fe70e80bd7af68b1
SHA1

49b6fd55ae0214dc6e85a025f6c185b85a170993
SHA256

960603e1605112d14f16bdbf904b4784bee023b5f4ccb333d0b962a0da0b4875
SHA512

8d4a8599f9c7bc27e09be3aa0d149d07b3fee16b18555281decb710cf9e317ee49c5f8e8fa6f97c6ce39704d4690642544225e841f68d0d94e2ec1ec0ff4ca34
SSDEEP

6144:utCFEkRDVRwR27lWjjllGkojmrbB7/ud+:NDRDHwWWCSBk+

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 12 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\system32\config\SVCHOST.EXE = "C:\\Windows\\system32\\config\\SVCHOST.EXE:*:Enabled:@xpsp2res.dll,-22001"	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\system32\config\SVCHOST.EXE = "C:\\Windows\\system32\\config\\SVCHOST.EXE:*:Enabled:@xpsp2res.dll,-22001"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\system32\config\SVCHOST.EXE = "C:\\Windows\\system32\\config\\SVCHOST.EXE:*:Enabled:@xpsp2res.dll,-22001"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\system32\config\SVCHOST.EXE = "C:\\Windows\\system32\\config\\SVCHOST.EXE:*:Enabled:@xpsp2res.dll,-22001"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\system32\config\SVCHOST.EXE = "C:\\Windows\\system32\\config\\SVCHOST.EXE:*:Enabled:@xpsp2res.dll,-22001"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\system32\config\SVCHOST.EXE = "C:\\Windows\\system32\\config\\SVCHOST.EXE:*:Enabled:@xpsp2res.dll,-22001"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list	SVCHOST.EXE

Executes dropped EXE 5 IoCs

pid	Process
2068	SVCHOST.EXE
2712	SVCHOST.EXE
2644	SVCHOST.EXE
2344	SVCHOST.EXE
1800	SVCHOST.EXE

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File opened for modification	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File created	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File opened for modification	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File created	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File opened for modification	C:\Windows\SysWOW64\config\SVCHOST.EXE	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\SVCHOST.EXE	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File created	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File opened for modification	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File created	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE
File opened for modification	C:\Windows\SysWOW64\config\SVCHOST.EXE	SVCHOST.EXE

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INETINFO.exe	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
File created	C:\Windows\INETINFO.exe	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
File opened for modification	C:\Windows\INETINFO.exe	SVCHOST.EXE
File opened for modification	C:\Windows\INETINFO.exe	SVCHOST.EXE
File opened for modification	C:\Windows\INETINFO.exe	SVCHOST.EXE
File opened for modification	C:\Windows\INETINFO.exe	SVCHOST.EXE
File opened for modification	C:\Windows\INETINFO.exe	SVCHOST.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c12387bb2a41646fe70e80bd7af68b1_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2296

C:\Windows\SysWOW64\config\SVCHOST.EXE
C:\Windows\SysWOW64\config\SVCHOST.EXE
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2068

C:\Windows\SysWOW64\config\SVCHOST.EXE
C:\Windows\SysWOW64\config\SVCHOST.EXE
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2712

C:\Windows\SysWOW64\config\SVCHOST.EXE
C:\Windows\SysWOW64\config\SVCHOST.EXE
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2644

C:\Windows\SysWOW64\config\SVCHOST.EXE
C:\Windows\SysWOW64\config\SVCHOST.EXE
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2344

C:\Windows\SysWOW64\config\SVCHOST.EXE
C:\Windows\SysWOW64\config\SVCHOST.EXE
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\config\SVCHOST.EXE

Filesize
92KB

MD5
919031b132a29a5f7af69cf6529f1a23

SHA1
d209741f55a0ca607fb06453442067f8f70df0d8

SHA256
cc6cf8864f9097b4072869b06354609fc5e21acde7402f0c294ce39f6b8e653b

SHA512
1b15f1ca6fb1f6fe42e5cafb93f2a359194ddc07f6d34ac8cd0ed3fc723d39c5f32184cbd87056e4a08d5f0cc15ef8d5016fe05763250956ed64bcaed5fa64bf

Download Submit
memory/2296-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2296-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2296-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads