1a6f5763209e0cd737187f67512d802d230ba4b99e3ff138e9239e9c061c1500

General

Target

03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
Size

1.5MB
MD5

03bdd677a29b5a54629f5556ccf0bd8a
SHA1

0405fcb4e5d38df434442d9f7c911b44ee9840c0
SHA256

1a6f5763209e0cd737187f67512d802d230ba4b99e3ff138e9239e9c061c1500
SHA512

59d6c2ac864af6c1cba092105c93297707503a354e2d5e2aab3c744afc0ad7f30cb72be7aba2f82f1f4a54964639b7dd0abd4dd5016e557bc09afb9a391bca2a
SSDEEP

24576:IKN3qU44VnMqFMygvWgQBQSRWxq0VJHTo6FaTLbI2ZqaIvuVnXN:I06Mw6ySYqQk6FaTXIGq969

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe

description ioc process

File opened for modification \??\c:\windows\SysWOW64\explorer.exe 03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\explorer.exe	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe

pid	process
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe

description	pid	process	target process
PID 2888 wrote to memory of 2380	2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe	explorer.exe
PID 2888 wrote to memory of 2380	2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe	explorer.exe
PID 2888 wrote to memory of 2380	2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe	explorer.exe
PID 2888 wrote to memory of 2380	2888	03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03bdd677a29b5a54629f5556ccf0bd8a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888

C:\windows\SysWOW64\explorer.exe
"C:\windows\system32\explorer.exe"
2⤵
PID:2380

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing