9b51a323e5838bb4b92821f455f6f0f92b5610f39cef8dfd31e4be781d5ec74c

General

Target

ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe
Size

24KB
MD5

ff6095846feb77189c8b1fcf2d075229
SHA1

db36092ed19580edb881e0dbe3cbdf5ae339ba7c
SHA256

9b51a323e5838bb4b92821f455f6f0f92b5610f39cef8dfd31e4be781d5ec74c
SHA512

60a6be205b41836c8e8ad4d98d44cbb33c7d069e3fd5b783fd47c54a113c544e6967832fed7779e8d842f2358a7dcd6ac44f55d0ec2afcb1c72c076a91b5d77d
SSDEEP

384:E3eVES+/xwGkRKJj5pOlM61qmTTMVF9/q5C0:bGS+ZfbJtEO8qYoAD

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
412	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3940	ipconfig.exe
3992	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	412	tasklist.exe
Token: SeDebugPrivilege	3992	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4832	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe
4832	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3600	4832	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe	93
PID 4832 wrote to memory of 3600	4832	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe	93
PID 4832 wrote to memory of 3600	4832	ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe	93
PID 3600 wrote to memory of 444	3600	cmd.exe	95
PID 3600 wrote to memory of 444	3600	cmd.exe	95
PID 3600 wrote to memory of 444	3600	cmd.exe	95
PID 3600 wrote to memory of 3940	3600	cmd.exe	96
PID 3600 wrote to memory of 3940	3600	cmd.exe	96
PID 3600 wrote to memory of 3940	3600	cmd.exe	96
PID 3600 wrote to memory of 412	3600	cmd.exe	97
PID 3600 wrote to memory of 412	3600	cmd.exe	97
PID 3600 wrote to memory of 412	3600	cmd.exe	97
PID 3600 wrote to memory of 3852	3600	cmd.exe	99
PID 3600 wrote to memory of 3852	3600	cmd.exe	99
PID 3600 wrote to memory of 3852	3600	cmd.exe	99
PID 3852 wrote to memory of 2892	3852	net.exe	100
PID 3852 wrote to memory of 2892	3852	net.exe	100
PID 3852 wrote to memory of 2892	3852	net.exe	100
PID 3600 wrote to memory of 3992	3600	cmd.exe	101
PID 3600 wrote to memory of 3992	3600	cmd.exe	101
PID 3600 wrote to memory of 3992	3600	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff6095846feb77189c8b1fcf2d075229_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:444
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:412
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2892
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
e57b63470f949681ba418b2079252e61

SHA1
a9888974a46ebfd8627c3beabeb74460bd2438fa

SHA256
9a78ccea0a18cc078bf76a42ecdecafe50846a429dab174d6ff7579fb819d46d

SHA512
7b96311cf87073dee4acc0284003f390c1f4836119ffc17863f8c17113a0875666397dd90a1478fedbd492767b6c93cb2e62ea1db08f2213b211d9a8e387e7a1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads