f52f21c0ad534a6dc44b925904cac17cd926e3df6e0a53bc6f5aa692074f44fd

General

Target

5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Size

2.5MB
MD5

5c1385b0694df84045307ba0060aefe3
SHA1

c0b056ec6d7a17d85a310c0f662e758e0be980fa
SHA256

f52f21c0ad534a6dc44b925904cac17cd926e3df6e0a53bc6f5aa692074f44fd
SHA512

6718626851ac113011c057aae239e43f59bb2fabd381b0d31409c871e0ea23398294bfa09b344699f5954a2a8ff2a19c0bc03a5175a25291dcd0e02fae423bd1
SSDEEP

24576:2CeD7lNsMtVXRU02nr6KfxTx+g5MJQPHE1mz7w/3MS2SXH:1e8q6/r6Kd+gNgmY/8UX

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2008	5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c1385b0694df84045307ba0060aefe3_JaffaCakes118.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x00000000029F0000-0x0000000002B31000-memory.dmp

Filesize
1.3MB

Download
memory/2008-3-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2008-2-0x00000000029F0000-0x0000000002B31000-memory.dmp

Filesize
1.3MB

Download
memory/2008-4-0x0000000000400000-0x0000000000DC4000-memory.dmp

Filesize
9.8MB

Download
memory/2008-5-0x0000000000400000-0x0000000000DC4000-memory.dmp

Filesize
9.8MB

Download
memory/2008-6-0x0000000000400000-0x0000000000DC4000-memory.dmp

Filesize
9.8MB

Download
memory/2008-7-0x0000000000400000-0x0000000000DC4000-memory.dmp

Filesize
9.8MB

Download
memory/2008-8-0x00000000029F0000-0x0000000002B31000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing