653244add20fc777b4a48e2bca4e4814d285a9ff575546f47a1bd8f12a8d1abb

General

Target

0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Size

2.3MB
MD5

0a6efe0481458ca3195a09dc221092c3
SHA1

2e084c1b66f805fe6113118d316615e3675505b4
SHA256

653244add20fc777b4a48e2bca4e4814d285a9ff575546f47a1bd8f12a8d1abb
SHA512

c4c442db62c91c68033b707961e66cb19ecf301355685382e1814fd0b73604ee5a17ca33e588ca739747bae1ce60662d8144678ebf65c10c8cb5c9f80f9faea5
SSDEEP

24576:iIG8JYOZ1ztssyDyrujCA5XeBLKyAJM5/C4GJiU:iIG8rna3uKjzG/XGJiU

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4844	0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a6efe0481458ca3195a09dc221092c3_JaffaCakes118.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-0-0x0000000002A70000-0x0000000002B8C000-memory.dmp

Filesize
1.1MB

Download
memory/4844-2-0x0000000002A70000-0x0000000002B8C000-memory.dmp

Filesize
1.1MB

Download
memory/4844-3-0x0000000000400000-0x0000000000CC0000-memory.dmp

Filesize
8.8MB

Download
memory/4844-4-0x0000000000400000-0x0000000000CC0000-memory.dmp

Filesize
8.8MB

Download
memory/4844-5-0x0000000000E40000-0x0000000000F40000-memory.dmp

Filesize
1024KB

Download
memory/4844-6-0x0000000000400000-0x0000000000CC0000-memory.dmp

Filesize
8.8MB

Download
memory/4844-8-0x0000000002A70000-0x0000000002B8C000-memory.dmp

Filesize
1.1MB

Download
memory/4844-7-0x0000000000400000-0x0000000000CC0000-memory.dmp

Filesize
8.8MB

Download

Analysis

Sharing