kronos | d1aab6dfa1a45af81e2ef196e975a2fa9179e987ebec5ecf824a8d1cdbee4594

General

Target

d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe
Size

512KB
MD5

d2668c20ed0b1df8b6a7929face687e5
SHA1

142251ee0b37ee96b07cd477617c27d091595481
SHA256

d1aab6dfa1a45af81e2ef196e975a2fa9179e987ebec5ecf824a8d1cdbee4594
SHA512

235352d8c8bc4d31b5d7b17d36418aea560ee40b3dcc30f40ae0658d88d405f33b764283f2356c05d13cc80017db855c19d90ed2c606651e073719aaee833bf7
SSDEEP

6144:pJr2u3vc+qmw4GMQUYk5ffhC7qBT9qvhHYMVQSgt9uIYxC9RuAjlvXCx:X2QPqmw4G1qBT9MPVQfjLSEfs

Score

10^/10

kronos banker botnet discovery evasion persistence spyware stealer

Malware Config

Signatures

Kronos
banker botnet kronos

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\488dca4c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{9401EB66-8791-48FA-8873-5D39111CC6E0}\\488dca4c.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\488dca4c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{9401EB66-8791-48FA-8873-5D39111CC6E0}\\488dca4c.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

description pid process target process

PID 584 set thread context of 2852 584 DllHost.exe
PID 584 set thread context of 1688 584 wmiprvse.exe
Drops file in Windows directory 1 IoCs

Processes:

description ioc process

File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 584 set thread context of 2852	584		DllHost.exe
PID 584 set thread context of 1688	584		wmiprvse.exe

description	ioc	process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe

Suspicious behavior: MapViewOfSection 28 IoCs

Processes:

d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exesvchost.exe

pid	process
2352	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe
2352	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
2780	svchost.exe
584
584

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeDebugPrivilege	2780	svchost.exe
Token: SeAuditPrivilege	832
Token: SeAssignPrimaryTokenPrivilege	832
Token: SeIncreaseQuotaPrivilege	832
Token: SeSecurityPrivilege	832
Token: SeTakeOwnershipPrivilege	832
Token: SeLoadDriverPrivilege	832
Token: SeSystemtimePrivilege	832
Token: SeBackupPrivilege	832
Token: SeRestorePrivilege	832
Token: SeShutdownPrivilege	832
Token: SeSystemEnvironmentPrivilege	832
Token: SeUndockPrivilege	832
Token: SeManageVolumePrivilege	832
Token: SeAssignPrimaryTokenPrivilege	832
Token: SeIncreaseQuotaPrivilege	832
Token: SeSecurityPrivilege	832
Token: SeTakeOwnershipPrivilege	832
Token: SeLoadDriverPrivilege	832
Token: SeSystemtimePrivilege	832
Token: SeBackupPrivilege	832
Token: SeRestorePrivilege	832
Token: SeShutdownPrivilege	832
Token: SeSystemEnvironmentPrivilege	832
Token: SeUndockPrivilege	832
Token: SeManageVolumePrivilege	832
Token: SeAssignPrimaryTokenPrivilege	832
Token: SeIncreaseQuotaPrivilege	832
Token: SeSecurityPrivilege	832
Token: SeTakeOwnershipPrivilege	832
Token: SeLoadDriverPrivilege	832
Token: SeSystemtimePrivilege	832
Token: SeBackupPrivilege	832
Token: SeRestorePrivilege	832
Token: SeShutdownPrivilege	832
Token: SeSystemEnvironmentPrivilege	832
Token: SeUndockPrivilege	832
Token: SeManageVolumePrivilege	832

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe

pid process

2352 d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

pid process

584
1780

pid	process
584
1780

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe

description	pid	process	target process
PID 2352 wrote to memory of 2780	2352	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe	svchost.exe
PID 2352 wrote to memory of 2780	2352	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe	svchost.exe
PID 2352 wrote to memory of 2780	2352	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe	svchost.exe
PID 2352 wrote to memory of 2780	2352	d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe	svchost.exe
PID 388 wrote to memory of 1184	388		Explorer.EXE
PID 340 wrote to memory of 2852	340		DllHost.exe
PID 584 wrote to memory of 2852	584		DllHost.exe
PID 584 wrote to memory of 2852	584		DllHost.exe
PID 584 wrote to memory of 2852	584		DllHost.exe
PID 340 wrote to memory of 1688	340		wmiprvse.exe
PID 340 wrote to memory of 1688	340		wmiprvse.exe
PID 584 wrote to memory of 1688	584		wmiprvse.exe
PID 584 wrote to memory of 1688	584		wmiprvse.exe
PID 584 wrote to memory of 1688	584		wmiprvse.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d2668c20ed0b1df8b6a7929face687e5_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2852

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/256-19-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download
memory/256-35-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download
memory/272-48-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/292-53-0x0000000000A50000-0x0000000000A55000-memory.dmp

Filesize
20KB

Download
memory/340-23-0x0000000000970000-0x0000000000975000-memory.dmp

Filesize
20KB

Download
memory/376-26-0x00000000000E0000-0x00000000000E5000-memory.dmp

Filesize
20KB

Download
memory/388-27-0x0000000000660000-0x0000000000665000-memory.dmp

Filesize
20KB

Download
memory/424-29-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/472-31-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download
memory/480-33-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download
memory/492-37-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/584-38-0x00000000004A0000-0x00000000004A5000-memory.dmp

Filesize
20KB

Download
memory/660-45-0x00000000002C0000-0x00000000002C5000-memory.dmp

Filesize
20KB

Download
memory/740-49-0x0000000000880000-0x0000000000885000-memory.dmp

Filesize
20KB

Download
memory/804-52-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/832-43-0x0000000000790000-0x0000000000795000-memory.dmp

Filesize
20KB

Download
memory/984-51-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download
memory/1064-55-0x0000000000100000-0x0000000000105000-memory.dmp

Filesize
20KB

Download
memory/1092-59-0x0000000000320000-0x0000000000325000-memory.dmp

Filesize
20KB

Download
memory/1152-60-0x00000000001A0000-0x00000000001A5000-memory.dmp

Filesize
20KB

Download
memory/1228-57-0x0000000001BD0000-0x0000000001BD5000-memory.dmp

Filesize
20KB

Download
memory/1624-61-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1780-64-0x0000000000280000-0x0000000000285000-memory.dmp

Filesize
20KB

Download
memory/1964-66-0x0000000000120000-0x0000000000125000-memory.dmp

Filesize
20KB

Download
memory/2352-5-0x0000000044CD0000-0x0000000044D55000-memory.dmp

Filesize
532KB

Download
memory/2352-12-0x0000000044CD0000-0x0000000044D55000-memory.dmp

Filesize
532KB

Download
memory/2352-0-0x00000000021E0000-0x00000000022D0000-memory.dmp

Filesize
960KB

Download
memory/2352-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2352-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2352-2-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2352-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2780-17-0x00000000000F0000-0x000000000010C000-memory.dmp

Filesize
112KB

Download
memory/2780-15-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2780-11-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/2780-10-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/2780-69-0x0000000001F10000-0x00000000020D4000-memory.dmp

Filesize
1.8MB

Download
memory/2852-70-0x0000000000050000-0x0000000000055000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads