6509a527ab29dad1e510c0a8c13d1717b422c65ce1036e92035e98ac133cf169

General

Target

ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Size

134KB
MD5

ec61be50ef62e693361b1fac146d064b
SHA1

6b8f182f5ce3be2edc90aef1b86a2e5a681e4c83
SHA256

6509a527ab29dad1e510c0a8c13d1717b422c65ce1036e92035e98ac133cf169
SHA512

11cdfa68819b4fca105cc93c415d6c42d11ae1153b60be1b0742a109d18e505f0cb65db20045cd845760610b671e4758bcb8fb1f4fa69f06f8af528ac9823fbd
SSDEEP

3072:+Hci6Tru5LrZrduuyJicj00ot7AOgppV4/Qxd7mFp:+f6TruxfuuFcI5t77V/Qrm

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\help\EB6C4499B05F.dll	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
File opened for modification	C:\Windows\help\EB6C4499B05F.dll	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\ = "SSUUDL"	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ = "C:\\Windows\\help\\EB6C4499B05F.dll"	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ThreadingModel = "Apartment"	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeBackupPrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeBackupPrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
Token: SeRestorePrivilege	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2320	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2320	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2320	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2320	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2536	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	30
PID 2008 wrote to memory of 2536	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	30
PID 2008 wrote to memory of 2536	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	30
PID 2008 wrote to memory of 2536	2008	ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec61be50ef62e693361b1fac146d064b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 2.bat
  2⤵
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 2.bat
  2⤵
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2.bat

Filesize
64B

MD5
3fbff1d433718681f9d8b39c40009177

SHA1
71aaacf1706765be304739a8893a8f6e54b08e73

SHA256
83631d7f9e78abb5271eacd1524de32fecaa107d8da35923fb66f0d3bb3ef3b2

SHA512
cf9e2b745b778b270910cdffc5f35da7953330cdc33852778ce62a1508c7d4e16ff8c3855038d1ceb4b8f8876f0b3c499200d9dd7b8160767bc40e666f9af6fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.bat

Filesize
63B

MD5
c3bf4d9cef5130ef993494d603b52fb5

SHA1
58d2a02d93d616bfdc069dda77d38a1319e1e63e

SHA256
c85c2f0a89782ab4c68f8ba6897668cfa7f316784c39ad2a8c51b4c8a2cc3e9c

SHA512
cc290a7da4bb1a8d3933e8dd73dde9bc4e8141f2b390e856383db6fe83a934ccf243f8eec4922b04b099f9ace8876c5e406e9e60e8c441589e2d3afa7bc08eb1

Download Submit
\Windows\Help\EB6C4499B05F.dll

Filesize
122KB

MD5
36337065c4cdd40becabcf2c9e246c89

SHA1
d9a37b903de6ff38bfd4053ace3ae88223447b71

SHA256
276f68fdba7235b0d038cdb53ad29ba5d48e21c3d2de1a604abe95e71c807218

SHA512
5a4a6831b5cb9b1f43075849ccaedeef7268d36911edc1ff95d00ca2b51e0330eeb072dbdf8db99d9f4b5b12b40dd3d4695c15ebbfd16fa3f3a7f4e70e8c4c1b

Download Submit
memory/2008-8-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2008-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2008-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2008-24-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2008-25-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2008-26-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2008-28-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing