45379b2a4ab8f51a5c3317273dbe29a159f70f6d84739b5a3d8dc27c25a02d18

General

Target

f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Size

157KB
MD5

f67fb6e8560fbd1130f21cb4726c3d8b
SHA1

bdf8f804a26b6470c0026d2617a92195f6cea4f8
SHA256

45379b2a4ab8f51a5c3317273dbe29a159f70f6d84739b5a3d8dc27c25a02d18
SHA512

28eea5780818a4abb967e95b6b6c56003122d549f2ed4ba2804c0f47bcd99cd9e4f10110e4026deba2c0cd8407ccd19a66ae2a6b837be040af4b764cee3c1fbe
SSDEEP

3072:6j9mD4Pa78AgZUUeXUbsCDUOBYJwyrN/sVywaEj1UszBt:6jYD4PawAJ1U4CDU3nh9wv1UABt

Score

6^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\crypto.dll	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3992	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
Token: SeDebugPrivilege	3992	f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f67fb6e8560fbd1130f21cb4726c3d8b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\lcss.exe

Filesize
210KB

MD5
b222059b699b2858bdf6097790d06ef2

SHA1
9011d6710fb86099dd190b02027302c2062270de

SHA256
d3641caa76e0ae524d6f3c6201f6115d71f16604c535ee761270b33e5da7ff36

SHA512
3ee3b26e165d8907c24d668fbb4c5cc62b51c3ab8bbc2716ca6cdeb3739cce8ee8dfcb15c570bd612e2e8a707637b1bf9009fd5885c93b43da543716c94685f8

Download Submit
C:\Windows\SysWOW64\net.cpl

Filesize
131KB

MD5
92e9a2f16de6f0af6bacade3ca73df52

SHA1
9ba512ac2e6f1380a7e49ef042573fbab1e73fc0

SHA256
7a38c3b050e10e35a8f647a6c2b473a87a2ffb2df1d47881108d684915d22e16

SHA512
09cc240ba2b25023f40d272344687eba554bfbaf1079e3eddff23d3d6e0f3fc28aee37b55bb2c161f1c5bd0c1d6139b3db25c869b7d0b12cd946a0277c289f46

Download Submit
memory/3992-24-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads