e742d814f76be6ec48320acc758119e9b87070852d97c0a9c1df1f0a4db68204

General

Target

68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe
Size

540KB
MD5

68f09936d4c6197af6544fab937da8c2
SHA1

f5e81aa37cc573d8f745faaab1f2ea49ce00faf2
SHA256

e742d814f76be6ec48320acc758119e9b87070852d97c0a9c1df1f0a4db68204
SHA512

e7efe2a2fd54f86f0e5cbc826d924348ef7c4febe8bf9af97f1457ed7c31757b132923897259246eb0be49ffc364cf181a218a0ec4f17f28f047b7e0ae7db830
SSDEEP

12288:GsEyDRw2XA4FJPR6dtE+Je+pDuYA/H6/uXn:GpydHXxJpMtYH6/qn

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

befabafddg_P.exe

pid process

2456 befabafddg_P.exe
Loads dropped DLL 2 IoCs

Processes:

68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe

pid process

1704 68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe
1704 68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2456	befabafddg_P.exe

pid	process
1704	68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe
1704	68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2684	wmic.exe
Token: SeSecurityPrivilege	2684	wmic.exe
Token: SeTakeOwnershipPrivilege	2684	wmic.exe
Token: SeLoadDriverPrivilege	2684	wmic.exe
Token: SeSystemProfilePrivilege	2684	wmic.exe
Token: SeSystemtimePrivilege	2684	wmic.exe
Token: SeProfSingleProcessPrivilege	2684	wmic.exe
Token: SeIncBasePriorityPrivilege	2684	wmic.exe
Token: SeCreatePagefilePrivilege	2684	wmic.exe
Token: SeBackupPrivilege	2684	wmic.exe
Token: SeRestorePrivilege	2684	wmic.exe
Token: SeShutdownPrivilege	2684	wmic.exe
Token: SeDebugPrivilege	2684	wmic.exe
Token: SeSystemEnvironmentPrivilege	2684	wmic.exe
Token: SeRemoteShutdownPrivilege	2684	wmic.exe
Token: SeUndockPrivilege	2684	wmic.exe
Token: SeManageVolumePrivilege	2684	wmic.exe
Token: 33	2684	wmic.exe
Token: 34	2684	wmic.exe
Token: 35	2684	wmic.exe
Token: SeIncreaseQuotaPrivilege	2684	wmic.exe
Token: SeSecurityPrivilege	2684	wmic.exe
Token: SeTakeOwnershipPrivilege	2684	wmic.exe
Token: SeLoadDriverPrivilege	2684	wmic.exe
Token: SeSystemProfilePrivilege	2684	wmic.exe
Token: SeSystemtimePrivilege	2684	wmic.exe
Token: SeProfSingleProcessPrivilege	2684	wmic.exe
Token: SeIncBasePriorityPrivilege	2684	wmic.exe
Token: SeCreatePagefilePrivilege	2684	wmic.exe
Token: SeBackupPrivilege	2684	wmic.exe
Token: SeRestorePrivilege	2684	wmic.exe
Token: SeShutdownPrivilege	2684	wmic.exe
Token: SeDebugPrivilege	2684	wmic.exe
Token: SeSystemEnvironmentPrivilege	2684	wmic.exe
Token: SeRemoteShutdownPrivilege	2684	wmic.exe
Token: SeUndockPrivilege	2684	wmic.exe
Token: SeManageVolumePrivilege	2684	wmic.exe
Token: 33	2684	wmic.exe
Token: 34	2684	wmic.exe
Token: 35	2684	wmic.exe
Token: SeIncreaseQuotaPrivilege	2608	wmic.exe
Token: SeSecurityPrivilege	2608	wmic.exe
Token: SeTakeOwnershipPrivilege	2608	wmic.exe
Token: SeLoadDriverPrivilege	2608	wmic.exe
Token: SeSystemProfilePrivilege	2608	wmic.exe
Token: SeSystemtimePrivilege	2608	wmic.exe
Token: SeProfSingleProcessPrivilege	2608	wmic.exe
Token: SeIncBasePriorityPrivilege	2608	wmic.exe
Token: SeCreatePagefilePrivilege	2608	wmic.exe
Token: SeBackupPrivilege	2608	wmic.exe
Token: SeRestorePrivilege	2608	wmic.exe
Token: SeShutdownPrivilege	2608	wmic.exe
Token: SeDebugPrivilege	2608	wmic.exe
Token: SeSystemEnvironmentPrivilege	2608	wmic.exe
Token: SeRemoteShutdownPrivilege	2608	wmic.exe
Token: SeUndockPrivilege	2608	wmic.exe
Token: SeManageVolumePrivilege	2608	wmic.exe
Token: 33	2608	wmic.exe
Token: 34	2608	wmic.exe
Token: 35	2608	wmic.exe
Token: SeIncreaseQuotaPrivilege	2664	wmic.exe
Token: SeSecurityPrivilege	2664	wmic.exe
Token: SeTakeOwnershipPrivilege	2664	wmic.exe
Token: SeLoadDriverPrivilege	2664	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exebefabafddg_P.exe

description	pid	process	target process
PID 1704 wrote to memory of 2456	1704	68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe	befabafddg_P.exe
PID 1704 wrote to memory of 2456	1704	68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe	befabafddg_P.exe
PID 1704 wrote to memory of 2456	1704	68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe	befabafddg_P.exe
PID 1704 wrote to memory of 2456	1704	68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe	befabafddg_P.exe
PID 2456 wrote to memory of 2684	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2684	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2684	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2684	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2608	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2608	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2608	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2608	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2664	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2664	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2664	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2664	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2524	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2524	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2524	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2524	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2816	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2816	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2816	2456	befabafddg_P.exe	wmic.exe
PID 2456 wrote to memory of 2816	2456	befabafddg_P.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68f09936d4c6197af6544fab937da8c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\befabafddg_P.exe
C:\Users\Admin\AppData\Local\Temp\befabafddg_P.exe 6)1)4)4)4)1)4)7)2)7)2 KU9FQDkwNTEyKx4pUlE+TEhANi4ZLUhEUFNLUUdCQjYuGi5ARU9TRT07KR4pQkVAOS8cKE5LTT5UP1BbSEA2LhktTUROUkFRW05QRTtic3BsNi4rbHBvLD5ET0cpU0tJKzpOSi1FSkJOHChBRUc9SkVAOR8rPS82KysfK0AuPCkqHihCLTwpLRwuQC07Ji8aLkAxOSwtGS1JUElDUT9QXkxLR08/PVg5HCtPTkhCTkFOXkFRSEA5GS1JUElDUT9QXko6Sz47Gi5BVEFeUUtKNh4pRFRBW0JJPUpCTD88HCtETk9NXTtQSVZPQU48MRktTUY7TUdVS1RbTlBFOxouUkk5MRwoQkwvNx8rTlFNUEJLPl1RREg/S0xBQks6RT9UTkg5HytCUVhQT01QRUlEOW1wbmMaLk5BUFROR0dHRVlUT0FOXkA6V0w7LB8rREVDQVE7Kh4pSE9bQFhKOktCQVlESj9OWExNQz07YGBob2EfKz1NUExGTj1AW0hMNjApNigwLSwqOC8nLyswGi5MPU5ASEVDRV1DTU9QPUtINnJrc18fK1BFTEE2Ly0zKjAzLTA4MRktPU1RTUhLPUNbTUdGQzcwListNCsrLiozJDg2LjA5MS4oOks=
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716418992.txt bios get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716418992.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716418992.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716418992.txt bios get version
3⤵
PID:2524

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716418992.txt bios get version
3⤵
PID:2816

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716418992.txt
Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\befabafddg_P.exe
Filesize
674KB

MD5
486247a05f1cf00430323245e59c49e3

SHA1
e6f76d4793f989265824c11c08e410ffb89b8f59

SHA256
07878b7939f0dffbd7238dd411959a9a9a2d3bdfc2ea09bd665be3d7c8d6793d

SHA512
7cb6359ebfb9a5115aaa29e97d430fd1b289f85bc289caf11e611f3063f33242ff09eead9244f4746d041b9589ed0f63dd35bf53db7bca03a03e7c22e881a00d

Download Submit
memory/2456-8-0x00000000757D1000-0x00000000757D2000-memory.dmp

Filesize
4KB

Download
memory/2456-9-0x00000000757C0000-0x00000000758D0000-memory.dmp

Filesize
1.1MB

Download
memory/2456-16-0x0000000000640000-0x00000000006E3000-memory.dmp

Filesize
652KB

Download
memory/2456-18-0x00000000757C0000-0x00000000758D0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing