e7e86f26dc61b2bd3711eb6110bfade3b693eff493b4e7c73048a360392d727f

General

Target

dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Size

361KB
MD5

dab4bb10521dc7f5220bf76417073dd2
SHA1

380e705e940692b76d5f69ed9d8037d0c7945d0e
SHA256

e7e86f26dc61b2bd3711eb6110bfade3b693eff493b4e7c73048a360392d727f
SHA512

eb94fe75bf8431eaffaa749a60354947d904442393e963589116e646fab6edd7f44e0e44b0fb988eae2b6d2acaff8f7b6de60614b614497e99784b168a41cf9b
SSDEEP

6144:wG0U5MXbo6l6WYodKuijOQRlVu6PiI2+De3VlnRgHG/lqg7x:5MXbok6WDKuaOQTVuWaXnRgm/lT7x

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3464	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
3464	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\DllName = "mdhcp32.dll"	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Startup = "WinStart2EX"	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Logoff = "WinOff2EX"	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Shutdown = "WinOff2EX"	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Asynchronous = "1"	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Impersonate = "0"	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shimg.dll	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dll.dll	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dab4bb10521dc7f5220bf76417073dd2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mdhcp32.dll

Filesize
49KB

MD5
514d88c84fd792c7f0786696a76bdc91

SHA1
127af32e27f6788f905d015aec5a0547302b05c5

SHA256
683ff213a5b29661a6e116c2f91ceb4decb70848cb63de6a7ec8fbd0711630a8

SHA512
6581d3aff103eb225820d1a2e5207f1510644a57ce417f4c03530224f7a76fff5e1640f401a932a686a659bef6cc40bd9205be6a166cfdb12d2c05c580bec486

Download Submit
memory/3464-19-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-17-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-12-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/3464-11-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-21-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-15-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-7-0x00000000026A0000-0x00000000026B2000-memory.dmp

Filesize
72KB

Download
memory/3464-2-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-13-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-23-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-25-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-27-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-29-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-31-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-33-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3464-35-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads