5610b2906ecd713913b4b7e2975788cecb0d19abf94a16d1f81d3b43e1b9adda

General

Target

7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe
Size

857KB
MD5

7d0aa3ac75755d1f7b67f12d0a362356
SHA1

2c7308e44a5a72ba8c70ac7d846b8b3c1878461a
SHA256

5610b2906ecd713913b4b7e2975788cecb0d19abf94a16d1f81d3b43e1b9adda
SHA512

4b419222720e3ac88c4f166da8f2675bf772703728d7763dd471e4b0f180d2d71c2fe1ac6dd8f1d6747780c0ad24ef7556b198047853d2d9da389085b15810e1
SSDEEP

12288:gsQ7lK3+yssh0MVIIu5a4chjuWXPm02elSqIYK3+mi3Y7ELzXbkU5d2BnCtz:grKu7shJjBPm0jkR9OmI4qzQU5dC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2512	655.exe

Loads dropped DLL 6 IoCs

pid	Process
2492	cmd.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2512-19-0x0000000000500000-0x000000000050A000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\655.exe -boot"	655.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2512	WerFault.exe	34

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe
Token: 33	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe
Token: SeDebugPrivilege	2512	655.exe
Token: 33	2512	655.exe
Token: SeIncBasePriorityPrivilege	2512	655.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2656	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2656	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2656	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2656	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	28
PID 2344 wrote to memory of 2492	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2492	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2492	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2492	2344	7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe	32
PID 2492 wrote to memory of 2512	2492	cmd.exe	34
PID 2492 wrote to memory of 2512	2492	cmd.exe	34
PID 2492 wrote to memory of 2512	2492	cmd.exe	34
PID 2492 wrote to memory of 2512	2492	cmd.exe	34
PID 2512 wrote to memory of 2692	2512	655.exe	35
PID 2512 wrote to memory of 2692	2512	655.exe	35
PID 2512 wrote to memory of 2692	2512	655.exe	35
PID 2512 wrote to memory of 2692	2512	655.exe	35

C:\Users\Admin\AppData\Local\Temp\7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\7d0aa3ac75755d1f7b67f12d0a362356_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\655.exe"
  2⤵
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\655.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\655.exe
    "C:\Users\Admin\AppData\Local\655.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1516
      4⤵
      Loads dropped DLL
      Program crash
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\655.exe

Filesize
857KB

MD5
7d0aa3ac75755d1f7b67f12d0a362356

SHA1
2c7308e44a5a72ba8c70ac7d846b8b3c1878461a

SHA256
5610b2906ecd713913b4b7e2975788cecb0d19abf94a16d1f81d3b43e1b9adda

SHA512
4b419222720e3ac88c4f166da8f2675bf772703728d7763dd471e4b0f180d2d71c2fe1ac6dd8f1d6747780c0ad24ef7556b198047853d2d9da389085b15810e1

Download Submit
memory/2344-4-0x00000000006C0000-0x00000000006C8000-memory.dmp

Filesize
32KB

Download
memory/2344-12-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-3-0x0000000005640000-0x0000000005680000-memory.dmp

Filesize
256KB

Download
memory/2344-0-0x0000000000130000-0x000000000020C000-memory.dmp

Filesize
880KB

Download
memory/2344-5-0x0000000001E30000-0x0000000001E3E000-memory.dmp

Filesize
56KB

Download
memory/2344-6-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-2-0x0000000000520000-0x0000000000550000-memory.dmp

Filesize
192KB

Download
memory/2344-1-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-7-0x0000000005640000-0x0000000005680000-memory.dmp

Filesize
256KB

Download
memory/2512-15-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-14-0x0000000000970000-0x0000000000A4C000-memory.dmp

Filesize
880KB

Download
memory/2512-16-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Filesize
256KB

Download
memory/2512-17-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-18-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Filesize
256KB

Download
memory/2512-19-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads