433f21cfcb30a5c2af0f8486946c54d5cdb2542abb875a8eec44ea7d9815d083

General

Target

e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe
Size

212KB
MD5

e0791e5c862d20a856dc667c9073e5ae
SHA1

e3b0f05b55f4b74ad3cf5f916e32706aded1a095
SHA256

433f21cfcb30a5c2af0f8486946c54d5cdb2542abb875a8eec44ea7d9815d083
SHA512

c6e0b5954363282f5099e0c1d599b605d7a9afbfa307f8692815bd5cbb076050972ce900ca4fee31c5f6d1e4500d38f2849f33ca79cb7b6155c17a4e294345eb
SSDEEP

6144:59YZwR57sJprYFMIscTkgBtPV9BPG9j0xWNkeXejJNp/DXUqf:YZs7sJprYFMyogBtPVjPaj0xWNkQmJNr

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\RECYCLER\\S-1-5-21-527237240-117609710-1177238915-500\\crfmon.exe\""	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	reg.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-5-21-527237240-117609710-1177238915-500\desktop.ini	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
396	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 876	396	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe	29
PID 396 wrote to memory of 876	396	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe	29
PID 396 wrote to memory of 876	396	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe	29
PID 396 wrote to memory of 876	396	e0791e5c862d20a856dc667c9073e5ae_JaffaCakes118.exe	29
PID 876 wrote to memory of 2968	876	cmd.exe	31
PID 876 wrote to memory of 2968	876	cmd.exe	31
PID 876 wrote to memory of 2968	876	cmd.exe	31
PID 876 wrote to memory of 2968	876	cmd.exe	31