22ed4f6e54f0e4bd471070a781d488dc0b374887f9c587a535d0ad04450bf812

General

Target

6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe
Size

270KB
MD5

6390e656e8c3f7d855c73624535b5292
SHA1

a751db486ff419a4c21cfd905200dc631aa9dcde
SHA256

22ed4f6e54f0e4bd471070a781d488dc0b374887f9c587a535d0ad04450bf812
SHA512

601a5209809fd5fe972e96088317316707a093fadc0f8a371d9c05122ce8ace82521a6b49da8cb2455e2a872ab3b853fbf91b7c2bffaeb8bc801ce84375c9fb4
SSDEEP

6144:DsaocyLCaAOJzNWQ1b9B8RvLO8dcLY42d/WVYX:Dtob7AIzYQZMRZdcLYf/OS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

ins5.exec44c0242-e47d-11e2-b66b-00259033c1da.exe

pid process

1756 ins5.exe
2648 c44c0242-e47d-11e2-b66b-00259033c1da.exe
Loads dropped DLL 3 IoCs

Processes:

6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exeins5.exe

pid process

2240 6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe
2240 6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe
1756 ins5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c44c0242-e47d-11e2-b66b-00259033c1da.exe

pid process

2648 c44c0242-e47d-11e2-b66b-00259033c1da.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c44c0242-e47d-11e2-b66b-00259033c1da.exe

description pid process

Token: SeDebugPrivilege 2648 c44c0242-e47d-11e2-b66b-00259033c1da.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c44c0242-e47d-11e2-b66b-00259033c1da.exe

pid process

2648 c44c0242-e47d-11e2-b66b-00259033c1da.exe
2648 c44c0242-e47d-11e2-b66b-00259033c1da.exe

pid	process
1756	ins5.exe
2648	c44c0242-e47d-11e2-b66b-00259033c1da.exe

pid	process
2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe
2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe
1756	ins5.exe

pid	process
2648	c44c0242-e47d-11e2-b66b-00259033c1da.exe

description	pid	process
Token: SeDebugPrivilege	2648	c44c0242-e47d-11e2-b66b-00259033c1da.exe

pid	process
2648	c44c0242-e47d-11e2-b66b-00259033c1da.exe
2648	c44c0242-e47d-11e2-b66b-00259033c1da.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exeins5.exe

description	pid	process	target process
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 2240 wrote to memory of 1756	2240	6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe	ins5.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe
PID 1756 wrote to memory of 2648	1756	ins5.exe	c44c0242-e47d-11e2-b66b-00259033c1da.exe

C:\Users\Admin\AppData\Local\Temp\6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6390e656e8c3f7d855c73624535b5292_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\ins5.exe
  C:\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\ins5.exe c44c0242-e47d-11e2-b66b-00259033c1da.exe /t1029d64f55af553bcd61200ff8dd48 /dT131981632S1029d64f55af553bcd61200ff8dd48 /e9504441 /uc44c0242-e47d-11e2-b66b-00259033c1da
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\c44c0242-e47d-11e2-b66b-00259033c1da.exe
    "C:\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\c44c0242-e47d-11e2-b66b-00259033c1da.exe" /t1029d64f55af553bcd61200ff8dd48 /dT131981632S1029d64f55af553bcd61200ff8dd48 /e9504441 /uc44c0242-e47d-11e2-b66b-00259033c1da
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\c44c0242-e47d-11e2-b66b-00259033c1da.exe

Filesize
250KB

MD5
035e4f28801f8a2f5c9a51750b1d8bc0

SHA1
6083a072e75b146941dc759796e1b539fd4846db

SHA256
46dd0dcd46ed04a5819e21810339dc160a28c6d77a12661549d4a6875c4312be

SHA512
b5f0b19672c425d5025411bb0bfb9f604723bf11ba0a04b202330d2675655e1b7cb31bd51314d77f000edb668307fcf9661e20d12238e2095961cb0b1277d945

Download Submit
\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\ins5.exe

Filesize
214KB

MD5
081f1ef743489a25c99fdd25f6d4f70d

SHA1
dfdbd1caf714644f6c1b1b383f717028c39a2db0

SHA256
ed6b25ef9345aa31303cdc1cad322b1607eda3bf7bfefe7445105baddd59c635

SHA512
bf2962affa9ffb92cbaa17389a71b6ecf548cf6629237444a4b078bdcbd29cdd825055e2fe49530053c864bb1ad42726c083bb7db6d20b0afc939363365ec4ca

Download Submit
\Users\Admin\AppData\Local\Temp\nsy81A0.tmp\nsExec.dll

Filesize
8KB

MD5
9f4abe9c1c095cdb505df5db52644d44

SHA1
94295f495f5535e0143107d3ca34141c943ec0b5

SHA256
e41bd375070919e1e194a7c1ca722a30d648a7fa7a4b5c33fb05660813c18bdf

SHA512
d1b6ab6d3e51f69e6ec79aa23629afc9ddedd8a7a668ea61b06bec115c95e2a35dca3ff9b9eb649e4bfece9a2fcd0832fed45f2308dca874f6e819708ed48169

Download Submit
memory/1756-11-0x0000000074A11000-0x0000000074A12000-memory.dmp

Filesize
4KB

Download
memory/1756-12-0x0000000074A10000-0x0000000074FBB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-13-0x0000000074A10000-0x0000000074FBB000-memory.dmp

Filesize
5.7MB

Download
memory/1756-21-0x0000000074A10000-0x0000000074FBB000-memory.dmp

Filesize
5.7MB

Download
memory/2240-25-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing