5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80

General

Target

eab6a28995e90af25717324836737614_JaffaCakes118.exe
Size

86KB
MD5

eab6a28995e90af25717324836737614
SHA1

de9839233a75d19ad359d0bd879f90d32ccbe310
SHA256

5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80
SHA512

3526b61f3ecedaee1a8870622bd19233fc52f0d6c2474e9dfc45022b808a0cbef06c51c9262f2b5c3a44858d8f14973fa8adeed4a260d02b7bbff0a1a6832ae4
SSDEEP

1536:D9gZKbuAOaQBUJSgI+Kc9/86z+mQynLOn2VeUEWFqDmwzUG98kE:nb3OaQBUSAzdQEd0UEWB5

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Notification Packages = 6100370032007a0037003000360070002e0064006c006c00000073006300650063006c00690000000000	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\a72z706p.dll	eab6a28995e90af25717324836737614_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a72z706p.dll	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1112	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	19
PID 2676 wrote to memory of 1112	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	19
PID 2676 wrote to memory of 1168	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	20
PID 2676 wrote to memory of 1168	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	20
PID 2676 wrote to memory of 1232	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	21
PID 2676 wrote to memory of 1232	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	21
PID 2676 wrote to memory of 1740	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	25
PID 2676 wrote to memory of 1740	2676	eab6a28995e90af25717324836737614_JaffaCakes118.exe	25

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\eab6a28995e90af25717324836737614_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eab6a28995e90af25717324836737614_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Boot or Logon Autostart Execution: Authentication Package
  - Drops file in System32 directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Authentication Package

1

T1547.002

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Authentication Package

1

T1547.002

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\s1803.tmp

Filesize
72KB

MD5
f8e771542080df468cb1801baa8a0ca0

SHA1
10b8303b03252fcf8662b11438857deedd68506d

SHA256
a4d05a978249ae4fdefb9217dfb2d976023a23b1bf7a07dace99dddf91064ec1

SHA512
88b936153d502e8447c15ebb33f657fadde892bd592d5838e54c792e275f0e2294b05c02213fd0c6ebd2287070b6195dc11de92a4803c6d6103c81a673cbad36

Download Submit
memory/1112-11-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/1112-9-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2676-0-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/2676-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads