16640a22d24f565fc9077dcf1f07fa6fd921d4c3eb5a08d05df2cbf2aa8caddb

General

Target

0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe
Size

3.1MB
MD5

0678b52eb5c2f580ec5f290bce91e309
SHA1

ddcc7622b762c618f746dac73fb14c5d4962958d
SHA256

16640a22d24f565fc9077dcf1f07fa6fd921d4c3eb5a08d05df2cbf2aa8caddb
SHA512

23d0322cdb105d87c7bdb09f039f1b43b5eba5e8a51213d0bd955e27c0e9304fcbcbc9c4bd3cc7743fce572e6824ba47fef1b929d9540bdd4b90531ca59d1ea3
SSDEEP

98304:ZLBJnvWdWLR63++Hvo3tBl9RvXI6GuBz6AtcfKN:XRvWdWLRohvItBlDXP6DK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp

Loads dropped DLL 6 IoCs

pid	Process
2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe
1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp
1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp
1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp
1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp
1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 2188 wrote to memory of 1012	2188	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe	28
PID 1012 wrote to memory of 2640	1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp	29
PID 1012 wrote to memory of 2640	1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp	29
PID 1012 wrote to memory of 2640	1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp	29
PID 1012 wrote to memory of 2640	1012	0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp	29
PID 2640 wrote to memory of 2864	2640	cmd.exe	31
PID 2640 wrote to memory of 2864	2640	cmd.exe	31
PID 2640 wrote to memory of 2864	2640	cmd.exe	31
PID 2640 wrote to memory of 2864	2640	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\is-VN12C.tmp\0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VN12C.tmp\0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp" /SL5="$30144,2916182,56832,C:\Users\Admin\AppData\Local\Temp\0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\ex.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\av.txt

Filesize
24B

MD5
f8f8258012893e0a2c957d226bdd7587

SHA1
ed482b5f912ef2d31e2b231df6b6e3b64967390c

SHA256
c341965a331692b4f79eed856a7da98c550d74fdef27d1241893284f1b51c3d2

SHA512
6e563814e4347ffa1da1d4d26ab45430987d5224c22278e1ee41b207700eb263aaab1e69088a5eeb267fdd385f36a61c0c66415f5df0887162eefbcbec9d19d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\ex.bat

Filesize
786B

MD5
ede848f260ab66e5912011e27fe9eee3

SHA1
a20a80c94b6aa1a1ee18b3fa632f08e1acad1a68

SHA256
41cbaa7edf5887b50bdef164af8d7c660e7c9780c590b83711c252747f31b021

SHA512
537a497c83c5fd02790f263747829e07ce974bc40fe4d8b0284ff0047b4c04d6356a6ddd3c9593f35a0d781c28805c7be8ded43f6e0216240c3860eb22356838

Download Submit
\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\isskin.dll

Filesize
385KB

MD5
92c2e247392e0e02261dea67e1bb1a5e

SHA1
db72fed8771364bf8039b2bc83ed01dda2908554

SHA256
25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68

SHA512
e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5

Download Submit
\Users\Admin\AppData\Local\Temp\is-R34H7.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
\Users\Admin\AppData\Local\Temp\is-VN12C.tmp\0678b52eb5c2f580ec5f290bce91e309_JaffaCakes118.tmp

Filesize
691KB

MD5
9303156631ee2436db23827e27337be4

SHA1
018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

SHA256
bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

SHA512
9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

Download Submit
memory/1012-24-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/1012-20-0x00000000003B0000-0x00000000003EC000-memory.dmp

Filesize
240KB

Download
memory/1012-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1012-34-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/1012-33-0x00000000003B0000-0x00000000003EC000-memory.dmp

Filesize
240KB

Download
memory/1012-32-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2188-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2188-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2188-37-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing