6655a03a944c8f55d9fdcc541d304f87f39cd897e97c8a9390576255fadd8197

General

Target

0d966df3068e9e01c58d8d7b9402f463_JaffaCakes118.msi
Size

967KB
MD5

0d966df3068e9e01c58d8d7b9402f463
SHA1

97c77d57a03a0e3f4b7dcc6b007b81d15b18bae6
SHA256

6655a03a944c8f55d9fdcc541d304f87f39cd897e97c8a9390576255fadd8197
SHA512

45ebeb877bc4351ad7a47e30cd0c0e568f8dc6d95e7addb07557e7992d089e161aac641f0711ac062a9ed9ce91cbc08fea26c8f7d727d109d74b20c6b6325b0c
SSDEEP

24576:GGOw7MAFZjiaZBuc2g4jocf6p2XHXNNpbCClCtRGLovJ+:QwHnjis3M6p2X/pbC7ALn

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\f7608c9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7608c9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85B.tmp	msiexec.exe

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

2292 MsiExec.exe
2292 MsiExec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2412 msiexec.exe
2412 msiexec.exe

pid	process
2292	MsiExec.exe
2292	MsiExec.exe

pid	process
2412	msiexec.exe
2412	msiexec.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2412	msiexec.exe
Token: SeTakeOwnershipPrivilege	2412	msiexec.exe
Token: SeSecurityPrivilege	2412	msiexec.exe
Token: SeCreateTokenPrivilege	2432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2432	msiexec.exe
Token: SeLockMemoryPrivilege	2432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2432	msiexec.exe
Token: SeMachineAccountPrivilege	2432	msiexec.exe
Token: SeTcbPrivilege	2432	msiexec.exe
Token: SeSecurityPrivilege	2432	msiexec.exe
Token: SeTakeOwnershipPrivilege	2432	msiexec.exe
Token: SeLoadDriverPrivilege	2432	msiexec.exe
Token: SeSystemProfilePrivilege	2432	msiexec.exe
Token: SeSystemtimePrivilege	2432	msiexec.exe
Token: SeProfSingleProcessPrivilege	2432	msiexec.exe
Token: SeIncBasePriorityPrivilege	2432	msiexec.exe
Token: SeCreatePagefilePrivilege	2432	msiexec.exe
Token: SeCreatePermanentPrivilege	2432	msiexec.exe
Token: SeBackupPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2432	msiexec.exe
Token: SeShutdownPrivilege	2432	msiexec.exe
Token: SeDebugPrivilege	2432	msiexec.exe
Token: SeAuditPrivilege	2432	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2432	msiexec.exe
Token: SeChangeNotifyPrivilege	2432	msiexec.exe
Token: SeRemoteShutdownPrivilege	2432	msiexec.exe
Token: SeUndockPrivilege	2432	msiexec.exe
Token: SeSyncAgentPrivilege	2432	msiexec.exe
Token: SeEnableDelegationPrivilege	2432	msiexec.exe
Token: SeManageVolumePrivilege	2432	msiexec.exe
Token: SeImpersonatePrivilege	2432	msiexec.exe
Token: SeCreateGlobalPrivilege	2432	msiexec.exe
Token: SeRestorePrivilege	2412	msiexec.exe
Token: SeTakeOwnershipPrivilege	2412	msiexec.exe
Token: SeRestorePrivilege	2412	msiexec.exe
Token: SeTakeOwnershipPrivilege	2412	msiexec.exe
Token: SeRestorePrivilege	2412	msiexec.exe
Token: SeTakeOwnershipPrivilege	2412	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2432 msiexec.exe
2432 msiexec.exe

pid	process
2432	msiexec.exe
2432	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe
PID 2412 wrote to memory of 2292	2412	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0d966df3068e9e01c58d8d7b9402f463_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A35796DB4E71E9BB17DBC78103242753
2⤵
- Loads dropped DLL
PID:2292

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Installer\MSI7BE.tmp
Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads