ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf

General

Target

61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe
Size

1.3MB
MD5

61955fbdb78a1954e1170de8a4282e97
SHA1

a7bbcc408c34700839914b117c373be786b5d00c
SHA256

ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf
SHA512

ac84c79978dd683cc8ab3be82a7af6d09a5636a08ffb50e1c7654d61411f08032d349a0399484804c1dc354bbf35da054e0881f0cf9ec46d545a7b4034971b3c
SSDEEP

24576:JIiitssH7bTpxajpLysxkrBpoiI+vM3mRN6nRRg:OXPH7ypL/xklO3yN6nRRg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2456	Au_.exe

Loads dropped DLL 5 IoCs

pid	Process
1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe
2456	Au_.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe
Token: SeDebugPrivilege	2456	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28
PID 1908 wrote to memory of 2456	1908	61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61955fbdb78a1954e1170de8a4282e97_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\isx.dll

Filesize
403KB

MD5
c871a7588af48899702611e0542197e8

SHA1
9c48f4313ead4955ac2a54db94178f66200af557

SHA256
c271707501470fdd06d89b01963d8ddc653a6f14e31bea6276f9d087358de9c1

SHA512
7b38f54e599202deeb161b65754bce132b85cc3412178a8e9a5681d2506534e0e379182815cf8b5f8fd3c47d7fa0976d12015efa72d4cd5d8653491c66565bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC61.tmp\kgskin.dll

Filesize
456KB

MD5
df5258b74cc1238a5cb59e860e756904

SHA1
210089135570cd64eb01d13cedcb95f030f8f26f

SHA256
04569051e07d0418463c2ea2958f80472c30549beb139a421583ad663df4a992

SHA512
739a39dde21251f01081a7f3709d3e1b9136ddf96a27da6caeff70c76b48bcf8e419af7f7054c1d913843fd0e9dd735278295b113f8160b7129d845724f7a7ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
1.3MB

MD5
61955fbdb78a1954e1170de8a4282e97

SHA1
a7bbcc408c34700839914b117c373be786b5d00c

SHA256
ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf

SHA512
ac84c79978dd683cc8ab3be82a7af6d09a5636a08ffb50e1c7654d61411f08032d349a0399484804c1dc354bbf35da054e0881f0cf9ec46d545a7b4034971b3c

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\System.dll

Filesize
11KB

MD5
13fec0696a4173f42dd2fca2acb6175b

SHA1
50452ada2548044dcd059f875dbe01d29dcda510

SHA256
10a7572263d67996260ef440c5528dbc4637375bbca69f6ad09d7de13c2051fe

SHA512
1d5ea7988b4c9a6207bc4df8257ea62dfd66f0a734dfabf1c3a33b17f449e97348f6b7667cfa3d0b7371a761a4e3f3cfb86e4ac356ba65a112137a9ad451c78a

Download Submit
\Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsDialogs.dll

Filesize
9KB

MD5
b326d9dbf5b2eb017f5e24827b6cc067

SHA1
90de73d5a50cb043b1e20d903fdd6953eed197d4

SHA256
53a14962ce9a1bdd7d6f571e74e0081b9829fa60b49c6916a7007f7446d9ef6d

SHA512
d854e4fe9f8aeaa7de2dc08090d2f8400fbfc1ef7ba45b34d83c61ea1cb660777d44547fdcf8f659ab3d29892d4e27edc872a090ef0f71140182c8f98b17e95f

Download Submit

Analysis

Sharing