b9b190309c9bc2b718fdf7d6c186ef9a770e632404538412fff71addd1cc2556

General

Target

3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Size

2.2MB
MD5

3a386ad56d4b3ff8496f2e1898fe3426
SHA1

7b460ac517baf0d8a4d3dfaa64e593965fc1794c
SHA256

b9b190309c9bc2b718fdf7d6c186ef9a770e632404538412fff71addd1cc2556
SHA512

b28d137138612bb3becbf29719693c064586493c92501fb50f9db6e9633bc85d252e5dc44d0e7ab38d44783391e277b811da342b2f2d53eb89e39b21a9556c68
SSDEEP

24576:0iilWWab7BXfE6PgHdiXe7Xa33Zo3WSH9bbvfNe:0iil2XBXfEogHdiuLa3ib9vnA

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WFHt47e6Si0o	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
File opened for modification	C:\Windows\OSG8Eraa5Sh7ttu	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1136	3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a386ad56d4b3ff8496f2e1898fe3426_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-0-0x0000000002BC0000-0x0000000002D96000-memory.dmp

Filesize
1.8MB

Download
memory/1136-2-0x0000000002BC0000-0x0000000002D96000-memory.dmp

Filesize
1.8MB

Download
memory/1136-3-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/1136-4-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1136-5-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1136-6-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1136-7-0x0000000000400000-0x0000000000D51000-memory.dmp

Filesize
9.3MB

Download
memory/1136-8-0x0000000002BC0000-0x0000000002D96000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing