17257b9ae489bae430e254fded19f00e9ddbce3539c1a3d9bcc4397de80add14

General

Target

b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe
Size

1.0MB
MD5

b6bd056193b17362bc877efc436f6bd6
SHA1

af80ead0ff0197192f41ad9083936c959cef97dc
SHA256

17257b9ae489bae430e254fded19f00e9ddbce3539c1a3d9bcc4397de80add14
SHA512

4f2ea14572cb7792f3caa11ce61b5ed2c841ada510382bb47359c3664c01b7335975dc74a8ebc82d6aee17ea54be0ce4ec5aabc7cd6ed92ad43125d89c6e6081
SSDEEP

24576:MVBGhPCKeFhCpTBk9mm+uTzHKcTBZwmDI3TdPAzfc:MHGhPCzFhCTwzHVTjH8uz

Score

10^/10

discovery evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
620	reg.exe
3176	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe
2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3120	2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe	87
PID 2604 wrote to memory of 3120	2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe	87
PID 2604 wrote to memory of 3120	2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe	87
PID 3120 wrote to memory of 620	3120	cmd.exe	89
PID 3120 wrote to memory of 620	3120	cmd.exe	89
PID 3120 wrote to memory of 620	3120	cmd.exe	89
PID 2604 wrote to memory of 1068	2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe	94
PID 2604 wrote to memory of 1068	2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe	94
PID 2604 wrote to memory of 1068	2604	b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe	94
PID 1068 wrote to memory of 532	1068	cmd.exe	96
PID 1068 wrote to memory of 532	1068	cmd.exe	96
PID 1068 wrote to memory of 532	1068	cmd.exe	96
PID 532 wrote to memory of 3176	532	cmd.exe	97
PID 532 wrote to memory of 3176	532	cmd.exe	97
PID 532 wrote to memory of 3176	532	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6bd056193b17362bc877efc436f6bd6_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd /k C:\Windows\System32\reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Services\wscsvc /v Start /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Services\wscsvc /v Start /t REG_DWORD /d 0 /f
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd /k C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-0-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-1-0x0000000077364000-0x0000000077366000-memory.dmp

Filesize
8KB

Download
memory/2604-2-0x0000000000401000-0x000000000042C000-memory.dmp

Filesize
172KB

Download
memory/2604-3-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-4-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-5-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-7-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-6-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-8-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-9-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-10-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-12-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-11-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-13-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-14-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-15-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-16-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-17-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-18-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-19-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-20-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-21-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-22-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-23-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-24-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-25-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-26-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-27-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-28-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download
memory/2604-29-0x0000000000400000-0x0000000000646000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads