5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80

General

Target

eab6a28995e90af25717324836737614_JaffaCakes118.exe
Size

86KB
MD5

eab6a28995e90af25717324836737614
SHA1

de9839233a75d19ad359d0bd879f90d32ccbe310
SHA256

5d7183052f3d7db0ba66ea0b14610a3c5ef5def33f56924b2245e9da3977bc80
SHA512

3526b61f3ecedaee1a8870622bd19233fc52f0d6c2474e9dfc45022b808a0cbef06c51c9262f2b5c3a44858d8f14973fa8adeed4a260d02b7bbff0a1a6832ae4
SSDEEP

1536:D9gZKbuAOaQBUJSgI+Kc9/86z+mQynLOn2VeUEWFqDmwzUG98kE:nb3OaQBUSAzdQEd0UEWB5

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Notification Packages = 61006d0069006a00370065006a0031002e006f0063007800000073006300650063006c00690000000000	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\amij7ej1.ocx	eab6a28995e90af25717324836737614_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\amij7ej1.ocx	eab6a28995e90af25717324836737614_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	eab6a28995e90af25717324836737614_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe
2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2648	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	44
PID 2868 wrote to memory of 2648	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	44
PID 2868 wrote to memory of 2668	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	45
PID 2868 wrote to memory of 2668	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	45
PID 2868 wrote to memory of 2756	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2756	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	47
PID 2868 wrote to memory of 3516	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	56
PID 2868 wrote to memory of 3516	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	56
PID 2868 wrote to memory of 3608	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	57
PID 2868 wrote to memory of 3608	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	57
PID 2868 wrote to memory of 3808	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	58
PID 2868 wrote to memory of 3808	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	58
PID 2868 wrote to memory of 4024	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	59
PID 2868 wrote to memory of 4024	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	59
PID 2868 wrote to memory of 4092	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	60
PID 2868 wrote to memory of 4092	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	60
PID 2868 wrote to memory of 3200	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	61
PID 2868 wrote to memory of 3200	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	61
PID 2868 wrote to memory of 3868	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	62
PID 2868 wrote to memory of 3868	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	62
PID 2868 wrote to memory of 548	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	74
PID 2868 wrote to memory of 548	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	74
PID 2868 wrote to memory of 1988	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	76
PID 2868 wrote to memory of 1988	2868	eab6a28995e90af25717324836737614_JaffaCakes118.exe	76

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2668

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2756

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3516
- C:\Users\Admin\AppData\Local\Temp\eab6a28995e90af25717324836737614_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eab6a28995e90af25717324836737614_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Boot or Logon Autostart Execution: Authentication Package
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4024

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4092

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3200

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:548

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Authentication Package

1

T1547.002

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Authentication Package

1

T1547.002

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s1558.tmp

Filesize
72KB

MD5
f8e771542080df468cb1801baa8a0ca0

SHA1
10b8303b03252fcf8662b11438857deedd68506d

SHA256
a4d05a978249ae4fdefb9217dfb2d976023a23b1bf7a07dace99dddf91064ec1

SHA512
88b936153d502e8447c15ebb33f657fadde892bd592d5838e54c792e275f0e2294b05c02213fd0c6ebd2287070b6195dc11de92a4803c6d6103c81a673cbad36

Download Submit
memory/2868-0-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download
memory/2868-5-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads