0ec6f0ebaf4d0e0d90e965467890b780ecd3165d1fa3d8159f6bda06814c7cc0

General

Target

ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
Size

165KB
MD5

ed9cb2f3d3da05fc5ed9db498376aba6
SHA1

59036e34b960a219017329958213448e2cc191ec
SHA256

0ec6f0ebaf4d0e0d90e965467890b780ecd3165d1fa3d8159f6bda06814c7cc0
SHA512

8924201c8fb5360bc0cccebbbb600ee337e2f511ce81569162963c485f2ca26301790b8e5ba0d71ff643df803ec74537a0026596ea2d4567430553a136c41222
SSDEEP

3072:DJ60eHeen2sp7Z2gcsRxAry4yLcW9uf3/jv+Y2l2SsU5t1rb+ys9jGL7sY5:DJhZQxpZ2gcoCMB+jvH2XZ+7h9S

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe"	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82
PID 3676 wrote to memory of 4924	3676	ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ed9cb2f3d3da05fc5ed9db498376aba6_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Impair Defenses: Safe Mode Boot
  - Modifies WinLogon
  PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Impair Defenses

1

T1562

Safe Mode Boot

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4924-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4924-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4924-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4924-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4924-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads