db92c8e97ca70c655fab9e12b733eb21bec0a778697570b2153097a486dfca56

General

Target

477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe
Size

504KB
MD5

477b2fef777fd553b2bfd475a81ca7c4
SHA1

e4720bd59c2ce20ddbb7a46ddb2f0cf6948e6302
SHA256

db92c8e97ca70c655fab9e12b733eb21bec0a778697570b2153097a486dfca56
SHA512

fdaeb0c519146ceb2709834d7f7ff17a7179c2bae782e0843f337335882efd61773b2ef8b4c588912e6f084a1e869667c121cb8eb8d64e705a07e24c3f7e4468
SSDEEP

12288:7PUaKD0K/7qdlWFFs5ksLLei+wgKUi+ICe3BiLaw:7cakv/7vMOme1K5zw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

netprotocol.exe

pid process

2508 netprotocol.exe
Loads dropped DLL 2 IoCs

Processes:

477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe

pid process

2924 477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe
2924 477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

netprotocol.exe

pid process

2508 netprotocol.exe
2508 netprotocol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

netprotocol.exe

description pid process

Token: SeDebugPrivilege 2508 netprotocol.exe

pid	process
2508	netprotocol.exe

pid	process
2924	477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe
2924	477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe

pid	process
2508	netprotocol.exe
2508	netprotocol.exe

description	pid	process
Token: SeDebugPrivilege	2508	netprotocol.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exenetprotocol.execmd.exevbc.exe

description	pid	process	target process
PID 2924 wrote to memory of 2508	2924	477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe	netprotocol.exe
PID 2924 wrote to memory of 2508	2924	477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe	netprotocol.exe
PID 2924 wrote to memory of 2508	2924	477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe	netprotocol.exe
PID 2924 wrote to memory of 2508	2924	477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe	netprotocol.exe
PID 2508 wrote to memory of 2620	2508	netprotocol.exe	cmd.exe
PID 2508 wrote to memory of 2620	2508	netprotocol.exe	cmd.exe
PID 2508 wrote to memory of 2620	2508	netprotocol.exe	cmd.exe
PID 2508 wrote to memory of 2620	2508	netprotocol.exe	cmd.exe
PID 2620 wrote to memory of 2628	2620	cmd.exe	reg.exe
PID 2620 wrote to memory of 2628	2620	cmd.exe	reg.exe
PID 2620 wrote to memory of 2628	2620	cmd.exe	reg.exe
PID 2620 wrote to memory of 2628	2620	cmd.exe	reg.exe
PID 2508 wrote to memory of 2536	2508	netprotocol.exe	vbc.exe
PID 2508 wrote to memory of 2536	2508	netprotocol.exe	vbc.exe
PID 2508 wrote to memory of 2536	2508	netprotocol.exe	vbc.exe
PID 2508 wrote to memory of 2536	2508	netprotocol.exe	vbc.exe
PID 2536 wrote to memory of 2456	2536	vbc.exe	cvtres.exe
PID 2536 wrote to memory of 2456	2536	vbc.exe	cvtres.exe
PID 2536 wrote to memory of 2456	2536	vbc.exe	cvtres.exe
PID 2536 wrote to memory of 2456	2536	vbc.exe	cvtres.exe
PID 2508 wrote to memory of 2596	2508	netprotocol.exe	netprotocol.exe
PID 2508 wrote to memory of 2596	2508	netprotocol.exe	netprotocol.exe
PID 2508 wrote to memory of 2596	2508	netprotocol.exe	netprotocol.exe
PID 2508 wrote to memory of 2596	2508	netprotocol.exe	netprotocol.exe

C:\Users\Admin\AppData\Local\Temp\477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\477b2fef777fd553b2bfd475a81ca7c4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe" -n
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe" /f
4⤵
PID:2628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hqlj8pve.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES15F2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15F1.tmp"
4⤵
PID:2456

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe"
3⤵
PID:2596

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES15F2.tmp
Filesize
1KB

MD5
ba7aa726c41f450895de099ab99daa13

SHA1
53d0707a2441426881f094c4fdda45bd1131ab71

SHA256
b54d5df473ebe0461d973fd851e894a4fbb5577a370d5a004d4d3f4c4416b6e1

SHA512
6cad2994a5ae7e0379590e5dbfddd4fb652ea64e7a0b9fa1fe268086bae2333c64f25bb2a35535bf150aad0c622e5fe7800f4a560176fa933468f97eb9801d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\hqlj8pve.0.vb
Filesize
3KB

MD5
0735df742046fdf2506d580f13413938

SHA1
ecfffda0578caf0d72af86e4d122784fb6605c9e

SHA256
41343d222ec8f8b4034047160a2a469e830b1ed873a5e2d3c9eaca0c5118049b

SHA512
1cd5514638202fab803854e9b4262be7d19408f2ff00e105547bc00f145bb3e7ac29862841aba0bf56d11b28127ec3a9e78dba035ef5b5d9c6c968385f48c765

Download Submit
C:\Users\Admin\AppData\Local\Temp\hqlj8pve.cmdline
Filesize
200B

MD5
6aa8ce2fd8cb83f516329279bd5c40c2

SHA1
7e6c3b24ee8cf4cec379f722017d0a63dc53daf8

SHA256
bb44e31d0075ae88d3141b1f899d3812521a485c98b217e75fb2dbdf4c5e21e4

SHA512
59cd42a25432bd63952b78651ff9c1dd89496f15146afcb24c3401dd908f723b92f06653b9431a6069bd9a81d00c7b005d4c2ea67b6632d8f2c4efe446215163

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc15F1.tmp
Filesize
932B

MD5
7cf1d8d484d60075f253503f2b88be02

SHA1
2184fdabbfc770b08cc4cb51bc5b4c4ede5b0fdf

SHA256
e64dff2b790a8430b9d73c485733c57a15de5c7973cdb17ceeee9b607531dd79

SHA512
2f847c0679b35284ed4886e6d61859c77923584bc8c3d828606e641945ee9c05fd442d4f3299e015815fef906a4cffe13c0e310a5d4302516e1648d1f39cada0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\netprotocol.exe
Filesize
504KB

MD5
477b2fef777fd553b2bfd475a81ca7c4

SHA1
e4720bd59c2ce20ddbb7a46ddb2f0cf6948e6302

SHA256
db92c8e97ca70c655fab9e12b733eb21bec0a778697570b2153097a486dfca56

SHA512
fdaeb0c519146ceb2709834d7f7ff17a7179c2bae782e0843f337335882efd61773b2ef8b4c588912e6f084a1e869667c121cb8eb8d64e705a07e24c3f7e4468

Download Submit
memory/2508-15-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2508-17-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2508-31-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2924-0-0x00000000745B1000-0x00000000745B2000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2924-2-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download
memory/2924-16-0x00000000745B0000-0x0000000074B5B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing