5ab41d070ea49c63034f0e13c5d45ed25a61f9bd0f0805997f7f41129030d57d

General

Target

a82a567299027025e4278329500a7a15_JaffaCakes118.exe
Size

335KB
MD5

a82a567299027025e4278329500a7a15
SHA1

4b1e84e392ebe11002ff5b172e2504a0c805f308
SHA256

5ab41d070ea49c63034f0e13c5d45ed25a61f9bd0f0805997f7f41129030d57d
SHA512

7fbb869368a7f58b8bb4211988dde576ba9c3a528e5d0cfa6ff01476ef8564213dda07ed4091b45e30caa7d524a95765c865c01226fc7f6d229ca960967f46d8
SSDEEP

6144:qbnap5yXxC15Ir1kBgaNu6Wn01mqfEz2HNITPsEbRHr4UPLV4PJb0/kwkt24vVMX:S25yXxC0rKgaKnCT86yzHbRL4yV4hbSZ

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\cb4f2c37\\X"	Explorer.EXE

Deletes itself 1 IoCs

pid	Process
1228	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
336	csrss.exe
2712	X

Loads dropped DLL 2 IoCs

pid	Process
1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1772 set thread context of 1228	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a82a567299027025e4278329500a7a15_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{9d188ed4-7f0f-50e8-d51f-37567dd51fd0}	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9d188ed4-7f0f-50e8-d51f-37567dd51fd0}\u = "189"	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9d188ed4-7f0f-50e8-d51f-37567dd51fd0}\cid = "3428248655465893625"	a82a567299027025e4278329500a7a15_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
2712	X

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe
Token: SeDebugPrivilege	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 336	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	2
PID 336 wrote to memory of 620	336	csrss.exe	30
PID 336 wrote to memory of 620	336	csrss.exe	30
PID 1772 wrote to memory of 2712	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	31
PID 1772 wrote to memory of 2712	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	31
PID 1772 wrote to memory of 2712	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	31
PID 1772 wrote to memory of 2712	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	31
PID 2712 wrote to memory of 1188	2712	X	21
PID 1772 wrote to memory of 1228	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	32
PID 1772 wrote to memory of 1228	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	32
PID 1772 wrote to memory of 1228	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	32
PID 1772 wrote to memory of 1228	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	32
PID 1772 wrote to memory of 1228	1772	a82a567299027025e4278329500a7a15_JaffaCakes118.exe	32

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1188
- C:\Users\Admin\AppData\Local\Temp\a82a567299027025e4278329500a7a15_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a82a567299027025e4278329500a7a15_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Users\Admin\AppData\Local\cb4f2c37\X
    76.76.13.94:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:1228

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cb4f2c37\@

Filesize
2KB

MD5
f442c142da64b8c2b825b616408637c9

SHA1
ec950d2c16dac4549496287c11f059e0b0b4726d

SHA256
409392e5905b8a54d1f5c6bdb141ffdde846e51c9309b4bf8ae3203339bfec77

SHA512
591b8187e24e5c4e839017442201569a35b924f7743b93ab04ae3ea67ba2e7c6b1b3d4cb6ed9b0bb8132c964df6c8878cd69d0c63ee214010302a51d17e64615

Download Submit
C:\Windows\system32\consrv.dll

Filesize
31KB

MD5
dafc4a53954b76c5db1d857e955f3805

SHA1
a18fa0d38c6656b4398953e77e87eec3b0209ef3

SHA256
c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

SHA512
745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

Download Submit
\Users\Admin\AppData\Local\cb4f2c37\X

Filesize
41KB

MD5
686b479b0ee164cf1744a8be359ebb7d

SHA1
8615e8f967276a85110b198d575982a958581a07

SHA256
fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

SHA512
7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
4376f2a61d75efe469d1c79280d8bdba

SHA1
86c2dfb69068a8f9c9b4d41148b8fdd86ec26eb5

SHA256
cafe46f240ddbef74c6ca4e792a8ca39e2e2079a16b26f9c7a6d39c1b2049c84

SHA512
a9571d3fba8732e27e0856ab9c5d221674baf1ba55fb42ff85ae9a8d665cc8267b11bb0b794113e2c63ab23948b925ef775dd8ab528bc756f5e4955ca8066c16

Download Submit
memory/336-16-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/336-19-0x0000000002560000-0x000000000256C000-memory.dmp

Filesize
48KB

Download
memory/336-18-0x0000000002560000-0x000000000256C000-memory.dmp

Filesize
48KB

Download
memory/336-21-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1188-42-0x0000000002930000-0x000000000293B000-memory.dmp

Filesize
44KB

Download
memory/1188-32-0x00000000020B0000-0x00000000020B8000-memory.dmp

Filesize
32KB

Download
memory/1188-46-0x0000000002930000-0x000000000293B000-memory.dmp

Filesize
44KB

Download
memory/1188-37-0x0000000002920000-0x000000000292B000-memory.dmp

Filesize
44KB

Download
memory/1188-33-0x0000000002920000-0x000000000292B000-memory.dmp

Filesize
44KB

Download
memory/1188-41-0x0000000002920000-0x000000000292B000-memory.dmp

Filesize
44KB

Download
memory/1772-9-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/1772-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1772-6-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/1772-3-0x00000000003C0000-0x00000000003ED000-memory.dmp

Filesize
180KB

Download
memory/1772-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1772-45-0x0000000000400000-0x000000000045D928-memory.dmp

Filesize
374KB

Download
memory/1772-12-0x0000000000400000-0x000000000045D928-memory.dmp

Filesize
374KB

Download
memory/1772-49-0x0000000000400000-0x000000000045D928-memory.dmp

Filesize
374KB

Download
memory/1772-50-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1772-2-0x0000000000400000-0x000000000045D928-memory.dmp

Filesize
374KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads