e2ae055cdc05ba3abb0fc6fe13496163de4c88e98ede89a73081346d978a04a2

General

Target

c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe
Size

3.3MB
MD5

c1cc58843c8cdb4665b2f2cbad644c01
SHA1

0829deafb730edf6870cb95ce0ec08fac6617b6c
SHA256

e2ae055cdc05ba3abb0fc6fe13496163de4c88e98ede89a73081346d978a04a2
SHA512

e8ec2479dc9b55e268d159e98afcfd3168d4da08b7c961c21f067cfb0549551098e0bae0910cb7b2baff545d52c0f107a82e6329c7a8a4646c1fdc71b2e43710
SSDEEP

98304:1oDhtnt/FPR9hOxTq2bzWvP9fyZwVsRsbn9Fk0hg8:ODvJFPR9hOY2bzYlaY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Loads dropped DLL 4 IoCs

pid	Process
2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe
2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp
2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp
2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
2236	taskkill.exe
2672	taskkill.exe
2580	taskkill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2392	2232	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2236	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	29
PID 2392 wrote to memory of 2236	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	29
PID 2392 wrote to memory of 2236	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	29
PID 2392 wrote to memory of 2236	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	29
PID 2392 wrote to memory of 2672	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	32
PID 2392 wrote to memory of 2672	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	32
PID 2392 wrote to memory of 2672	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	32
PID 2392 wrote to memory of 2672	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	32
PID 2392 wrote to memory of 2580	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	34
PID 2392 wrote to memory of 2580	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	34
PID 2392 wrote to memory of 2580	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	34
PID 2392 wrote to memory of 2580	2392	c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp	34

C:\Users\Admin\AppData\Local\Temp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\is-UNF46.tmp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UNF46.tmp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp" /SL5="$4010A,2928163,216576,C:\Users\Admin\AppData\Local\Temp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "DuplicatePhotosFixerPro.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "DuplicatePhotosFixerPro.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im "DuplicatePhotosFixerPro.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-A6A0S.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-A6A0S.tmp\isxdl.dll

Filesize
152KB

MD5
82201cd8f401f00000b7575b24b3ad0b

SHA1
fa3659e48990f2ab24f8e1bf9bb650f11641ffe0

SHA256
9d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67

SHA512
a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4

Download Submit
\Users\Admin\AppData\Local\Temp\is-UNF46.tmp\c1cc58843c8cdb4665b2f2cbad644c01_JaffaCakes118.tmp

Filesize
1.2MB

MD5
f1c5da2331fb8c0e25ffda0708d7b2df

SHA1
f54d113a434c1a7ba7ab696fa8189e723fb4d30f

SHA256
6a653fe8a916b9e76fee1905e01bcd5c01c7d3ae8f32ef1f5e4144c705709073

SHA512
f2e2e5e3f18f128d879d343ea8d07f3ef7ed26e606e0e1eaf35136219483ab81d94a3e2e934b208831a576bb8807e59862c6db02d89083c749395263edb5872e

Download Submit
memory/2232-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2232-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2392-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2392-19-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2392-22-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing