630793d812d85e763f5042ec21cfa2d5da436ee535fdd1ccd00b52c45f82ccb9

General

Target

d13d644d111ba1ad4a95d7c6dfd9b669_JaffaCakes118.msi
Size

264KB
MD5

d13d644d111ba1ad4a95d7c6dfd9b669
SHA1

3c9871a124d2eebeb68ebbfd49fe9b05320a4972
SHA256

630793d812d85e763f5042ec21cfa2d5da436ee535fdd1ccd00b52c45f82ccb9
SHA512

4f03ce84adfb108da2245914949a6a133b479d05fbde75ced318ad4142d34aebea0d318bdbfd66fd876e3fa146e9cd8379a32b4ebed3a5e37dd9624cf63a7ddb
SSDEEP

3072:VmDk2R903DaYlAdwgz88ereWn/7w05g0OMcB3RUN46ILJ9+ZB5yOannY:Vms3DaYlAI8er1nzTbrIY

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

MsiExec.exe

flow pid process

15 4648 MsiExec.exe

flow	pid	process
15	4648	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 5 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI1613.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FD8.tmp	msiexec.exe
File created	C:\Windows\Installer\e581400.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e581400.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

4648 MsiExec.exe
4648 MsiExec.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4648	MsiExec.exe
4648	MsiExec.exe

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3088	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3088	msiexec.exe
Token: SeSecurityPrivilege	3596	msiexec.exe
Token: SeCreateTokenPrivilege	3088	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3088	msiexec.exe
Token: SeLockMemoryPrivilege	3088	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3088	msiexec.exe
Token: SeMachineAccountPrivilege	3088	msiexec.exe
Token: SeTcbPrivilege	3088	msiexec.exe
Token: SeSecurityPrivilege	3088	msiexec.exe
Token: SeTakeOwnershipPrivilege	3088	msiexec.exe
Token: SeLoadDriverPrivilege	3088	msiexec.exe
Token: SeSystemProfilePrivilege	3088	msiexec.exe
Token: SeSystemtimePrivilege	3088	msiexec.exe
Token: SeProfSingleProcessPrivilege	3088	msiexec.exe
Token: SeIncBasePriorityPrivilege	3088	msiexec.exe
Token: SeCreatePagefilePrivilege	3088	msiexec.exe
Token: SeCreatePermanentPrivilege	3088	msiexec.exe
Token: SeBackupPrivilege	3088	msiexec.exe
Token: SeRestorePrivilege	3088	msiexec.exe
Token: SeShutdownPrivilege	3088	msiexec.exe
Token: SeDebugPrivilege	3088	msiexec.exe
Token: SeAuditPrivilege	3088	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3088	msiexec.exe
Token: SeChangeNotifyPrivilege	3088	msiexec.exe
Token: SeRemoteShutdownPrivilege	3088	msiexec.exe
Token: SeUndockPrivilege	3088	msiexec.exe
Token: SeSyncAgentPrivilege	3088	msiexec.exe
Token: SeEnableDelegationPrivilege	3088	msiexec.exe
Token: SeManageVolumePrivilege	3088	msiexec.exe
Token: SeImpersonatePrivilege	3088	msiexec.exe
Token: SeCreateGlobalPrivilege	3088	msiexec.exe
Token: SeRestorePrivilege	3596	msiexec.exe
Token: SeTakeOwnershipPrivilege	3596	msiexec.exe
Token: SeRestorePrivilege	3596	msiexec.exe
Token: SeTakeOwnershipPrivilege	3596	msiexec.exe
Token: SeRestorePrivilege	3596	msiexec.exe
Token: SeTakeOwnershipPrivilege	3596	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3088 msiexec.exe
3088 msiexec.exe

pid	process
3088	msiexec.exe
3088	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3596 wrote to memory of 4648	3596	msiexec.exe	MsiExec.exe
PID 3596 wrote to memory of 4648	3596	msiexec.exe	MsiExec.exe
PID 3596 wrote to memory of 4648	3596	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d13d644d111ba1ad4a95d7c6dfd9b669_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3088

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BC0A652327624B1F9E96D095CE90C9A0
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3628 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI1613.tmp

Filesize
91KB

MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads