fa3f7b8b7a1634289a4106e65d27e49693601f10c7ee134f535477b9c3c53477

General

Target

ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
Size

336KB
MD5

ea7d8b02707eca7440d341a240522d62
SHA1

82c63701350d586949f422ad7066452ffc9db5ec
SHA256

fa3f7b8b7a1634289a4106e65d27e49693601f10c7ee134f535477b9c3c53477
SHA512

4864de0ca4402c14d96e89559f0b7be7b48693e47a19f5f08ea75892099283ad3e1b3b1df63c3b7a41d9371551c20ba4d4f0a29653114bf000563586c3b24fb5
SSDEEP

6144:AJcTCaBYgiWTvWT4erFjf6iywWkYmZqYgn:AGTXB9iWper1f6LnWY

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	msconfig.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig.exe"	msconfig.exe

Executes dropped EXE 2 IoCs

pid	Process
2840	msconfig.exe
2968	msconfig.exe

Loads dropped DLL 3 IoCs

pid	Process
2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
2840	msconfig.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig.exe"	msconfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig.exe"	msconfig.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2840 set thread context of 2968	2840	msconfig.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
2968	msconfig.exe
2968	msconfig.exe
2968	msconfig.exe
2968	msconfig.exe
2968	msconfig.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
2840	msconfig.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2732	2404	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2840	2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2840	2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2840	2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2840	2732	ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe	31
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32
PID 2840 wrote to memory of 2968	2840	msconfig.exe	32

C:\Users\Admin\AppData\Local\Temp\ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ea7d8b02707eca7440d341a240522d62_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Roaming\msconfig.exe
    "C:\Users\Admin\AppData\Roaming\msconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Roaming\msconfig.exe
      C:\Users\Admin\AppData\Roaming\msconfig.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\msconfig.exe

Filesize
336KB

MD5
ea7d8b02707eca7440d341a240522d62

SHA1
82c63701350d586949f422ad7066452ffc9db5ec

SHA256
fa3f7b8b7a1634289a4106e65d27e49693601f10c7ee134f535477b9c3c53477

SHA512
4864de0ca4402c14d96e89559f0b7be7b48693e47a19f5f08ea75892099283ad3e1b3b1df63c3b7a41d9371551c20ba4d4f0a29653114bf000563586c3b24fb5

Download Submit
memory/2732-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-8-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-17-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-51-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/2968-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-61-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-64-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-66-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-67-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2968-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads