cba969c83a94890552bdcb91254715bf2fc8919245d51cd0a8a49f76dbb9ca9f

General

Target

8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
Size

337KB
MD5

8d60ebb9f7dcbf6fe2cd449e6f4a511a
SHA1

4418e364c1c09c241e856b798e19e9377ffe57a1
SHA256

cba969c83a94890552bdcb91254715bf2fc8919245d51cd0a8a49f76dbb9ca9f
SHA512

ee95c3b56be17531489f3bdd5a3e982ab22ee8468e0d8ef713262c05bc6c15ad007868920990c63b03540f867a968ea14f5f059ee3853a25baf6a34dc2c8df85
SSDEEP

6144:FucgMI9Z34jdOHfl8z2UL5gElJDbIjDdsaVFSwQaJYaPWFeN3gt7ekQ:5yZ34jdO/lUFRbKtVFCau9wN3Ae

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\04fa235b\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
2788	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
332	csrss.exe
2792	X

Loads dropped DLL 2 IoCs

pid	Process
784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 784 set thread context of 2788	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{07ff6090-7824-f88b-387c-b3a0a15df8b0}	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07ff6090-7824-f88b-387c-b3a0a15df8b0}\u = "40"	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07ff6090-7824-f88b-387c-b3a0a15df8b0}\cid = "1208214136396920334"	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
2792	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
Token: SeDebugPrivilege	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 332	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	2
PID 784 wrote to memory of 2792	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	31
PID 784 wrote to memory of 2792	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	31
PID 784 wrote to memory of 2792	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	31
PID 784 wrote to memory of 2792	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	31
PID 2792 wrote to memory of 1192	2792	X	21
PID 784 wrote to memory of 2788	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	32
PID 784 wrote to memory of 2788	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	32
PID 784 wrote to memory of 2788	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	32
PID 784 wrote to memory of 2788	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	32
PID 784 wrote to memory of 2788	784	8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe	32

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1192
- C:\Users\Admin\AppData\Local\Temp\8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8d60ebb9f7dcbf6fe2cd449e6f4a511a_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Users\Admin\AppData\Local\04fa235b\X
    193.105.154.210:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\04fa235b\@

Filesize
2KB

MD5
65f796b6e87db794bed4357c36a89578

SHA1
322eb904f282b654bc2c6e7c00e6dfe0b096778a

SHA256
19e7c5f1cb471e50b04865b6502580e41f36386c3abeb3623a34fcd19fdc3123

SHA512
7bd8f9ae2b7c1257175401f31c8dc1c88f836c29a3f294901281b13bc31e07c01efff15a9146701014257931d3f7bb2a22903e26e3217122891e9b862c34a38f

Download Submit
\Users\Admin\AppData\Local\04fa235b\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\Windows\System32\consrv.dll

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
a40e27bea1885238458601ed1d529b03

SHA1
f32e55a549d3a3e0cb2f181f6662833c301402c3

SHA256
117250c5e7898f7a3aaa03fc1b79fcca9fff365d7fd95de6b45753b983663847

SHA512
08ba3034be60922aace72d6cf58fc47a358e7768a0ce9b44e786463ecf6f1f336c2df1abf8a7bdf9e94d2c915134e769b25920eb03151b03a36ea28cab9d8f4b

Download Submit
memory/332-18-0x00000000023B0000-0x00000000023BC000-memory.dmp

Filesize
48KB

Download
memory/332-19-0x00000000023B0000-0x00000000023BC000-memory.dmp

Filesize
48KB

Download
memory/332-16-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/784-21-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/784-3-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/784-9-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/784-2-0x0000000000400000-0x000000000045DED4-memory.dmp

Filesize
375KB

Download
memory/784-6-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/784-43-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/784-42-0x0000000000400000-0x000000000045DED4-memory.dmp

Filesize
375KB

Download
memory/784-15-0x0000000000400000-0x000000000045DED4-memory.dmp

Filesize
375KB

Download
memory/784-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1192-45-0x0000000002F50000-0x0000000002F5B000-memory.dmp

Filesize
44KB

Download
memory/1192-39-0x0000000002F50000-0x0000000002F5B000-memory.dmp

Filesize
44KB

Download
memory/1192-38-0x0000000002EC0000-0x0000000002ECB000-memory.dmp

Filesize
44KB

Download
memory/1192-34-0x0000000002EC0000-0x0000000002ECB000-memory.dmp

Filesize
44KB

Download
memory/1192-30-0x0000000002EC0000-0x0000000002ECB000-memory.dmp

Filesize
44KB

Download
memory/1192-46-0x0000000002F50000-0x0000000002F5B000-memory.dmp

Filesize
44KB

Download
memory/1192-44-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads