a66d95aff5675c60665249145aeabd82d6391212064787b1e9842fc9af1138e3

General

Target

5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
Size

1.2MB
MD5

5bdbbf93a251e673d68d66cb50bf2d72
SHA1

e38d499d9f4d9694d6bb7027e5f103729416aac4
SHA256

a66d95aff5675c60665249145aeabd82d6391212064787b1e9842fc9af1138e3
SHA512

bff46116d2e675b557cf48fd0ae21a04e65e60d202e73614d11fa0d74179be2dfa899df2dd995f2a524ae41f7cb2613b7a4f245f355276f78246cc8107963254
SSDEEP

24576:D2uZd7yv0Aj3GICxc0XFByaZkLM38BqfNaE0Dy8FTSn0X8nhk0npgb:Dtf7yvpj21xc0XreQ3JwTS0XxGpg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

driver.exe

pid process

3064 driver.exe
Loads dropped DLL 2 IoCs

Processes:

5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe

pid process

2820 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
2820 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exedriver.exe

pid process

2820 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
3064 driver.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3056 schtasks.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exedriver.exe

pid process

2820 5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
3064 driver.exe

pid	process
3064	driver.exe

pid	process
2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe

pid	process
2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
3064	driver.exe

pid	process
3056	schtasks.exe

pid	process
2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
3064	driver.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe

description	pid	process	target process
PID 2820 wrote to memory of 3056	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 3056	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 3056	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 3056	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	schtasks.exe
PID 2820 wrote to memory of 3064	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	driver.exe
PID 2820 wrote to memory of 3064	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	driver.exe
PID 2820 wrote to memory of 3064	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	driver.exe
PID 2820 wrote to memory of 3064	2820	5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe	driver.exe

C:\Users\Admin\AppData\Local\Temp\5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\5bdbbf93a251e673d68d66cb50bf2d72_JaffaCakes118.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:3056

C:\Users\Admin\AppData\Roaming\driver\driver.exe
"C:\Users\Admin\AppData\Roaming\driver\driver.exe" -d2
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3064

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\driver\driver.exe
Filesize
1.2MB

MD5
5bdbbf93a251e673d68d66cb50bf2d72

SHA1
e38d499d9f4d9694d6bb7027e5f103729416aac4

SHA256
a66d95aff5675c60665249145aeabd82d6391212064787b1e9842fc9af1138e3

SHA512
bff46116d2e675b557cf48fd0ae21a04e65e60d202e73614d11fa0d74179be2dfa899df2dd995f2a524ae41f7cb2613b7a4f245f355276f78246cc8107963254

Download Submit
memory/2820-13-0x0000000006480000-0x000000000683E000-memory.dmp

Filesize
3.7MB

Download
memory/2820-24-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-3-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-1-0x000000007417E000-0x000000007417F000-memory.dmp

Filesize
4KB

Download
memory/2820-12-0x0000000006480000-0x000000000683E000-memory.dmp

Filesize
3.7MB

Download
memory/2820-0-0x0000000000950000-0x0000000000D0E000-memory.dmp

Filesize
3.7MB

Download
memory/2820-23-0x0000000000950000-0x0000000000D0E000-memory.dmp

Filesize
3.7MB

Download
memory/2820-2-0x0000000000950000-0x0000000000D0E000-memory.dmp

Filesize
3.7MB

Download
memory/3064-17-0x00000000011E0000-0x000000000159E000-memory.dmp

Filesize
3.7MB

Download
memory/3064-21-0x00000000011E0000-0x000000000159E000-memory.dmp

Filesize
3.7MB

Download
memory/3064-20-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/3064-16-0x00000000011E0000-0x000000000159E000-memory.dmp

Filesize
3.7MB

Download
memory/3064-18-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/3064-15-0x00000000011E0000-0x000000000159E000-memory.dmp

Filesize
3.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads