197ab0612c76e350a651a8e879f48c96d8037313adac2365889d6288676584a9

General

Target

657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe
Size

339KB
MD5

657bc9cd9affb2bf02fcdcff2a71b7d2
SHA1

e8f13b39fcc2f97119a73ef341fddbca4cecae74
SHA256

197ab0612c76e350a651a8e879f48c96d8037313adac2365889d6288676584a9
SHA512

0cedf59e99a2aaae63ce27e537b2f44f556e296c262bcc00b6d38a8a43e9dc304aa51b2a303ed67ed1cd03b3387b1900559df16b5aa2f99cf43298324f5120d9
SSDEEP

6144:lFJ0JRG1oFcuAJP1nd35uZ2/HLGBPhXy2tBs6q9o2lj/C:cSJX02K1Bywj2lj/C

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

beeiehibdh.exe

pid process

2872 beeiehibdh.exe
Loads dropped DLL 5 IoCs

Processes:

657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exeWerFault.exe

pid process

2204 657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe
3012 WerFault.exe
3012 WerFault.exe
3012 WerFault.exe
3012 WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3012 2872 WerFault.exe beeiehibdh.exe

pid	process
2872	beeiehibdh.exe

pid	process
2204	657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe

pid	pid_target	process	target process
3012	2872	WerFault.exe	beeiehibdh.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2972	wmic.exe
Token: SeSecurityPrivilege	2972	wmic.exe
Token: SeTakeOwnershipPrivilege	2972	wmic.exe
Token: SeLoadDriverPrivilege	2972	wmic.exe
Token: SeSystemProfilePrivilege	2972	wmic.exe
Token: SeSystemtimePrivilege	2972	wmic.exe
Token: SeProfSingleProcessPrivilege	2972	wmic.exe
Token: SeIncBasePriorityPrivilege	2972	wmic.exe
Token: SeCreatePagefilePrivilege	2972	wmic.exe
Token: SeBackupPrivilege	2972	wmic.exe
Token: SeRestorePrivilege	2972	wmic.exe
Token: SeShutdownPrivilege	2972	wmic.exe
Token: SeDebugPrivilege	2972	wmic.exe
Token: SeSystemEnvironmentPrivilege	2972	wmic.exe
Token: SeRemoteShutdownPrivilege	2972	wmic.exe
Token: SeUndockPrivilege	2972	wmic.exe
Token: SeManageVolumePrivilege	2972	wmic.exe
Token: 33	2972	wmic.exe
Token: 34	2972	wmic.exe
Token: 35	2972	wmic.exe
Token: SeIncreaseQuotaPrivilege	2972	wmic.exe
Token: SeSecurityPrivilege	2972	wmic.exe
Token: SeTakeOwnershipPrivilege	2972	wmic.exe
Token: SeLoadDriverPrivilege	2972	wmic.exe
Token: SeSystemProfilePrivilege	2972	wmic.exe
Token: SeSystemtimePrivilege	2972	wmic.exe
Token: SeProfSingleProcessPrivilege	2972	wmic.exe
Token: SeIncBasePriorityPrivilege	2972	wmic.exe
Token: SeCreatePagefilePrivilege	2972	wmic.exe
Token: SeBackupPrivilege	2972	wmic.exe
Token: SeRestorePrivilege	2972	wmic.exe
Token: SeShutdownPrivilege	2972	wmic.exe
Token: SeDebugPrivilege	2972	wmic.exe
Token: SeSystemEnvironmentPrivilege	2972	wmic.exe
Token: SeRemoteShutdownPrivilege	2972	wmic.exe
Token: SeUndockPrivilege	2972	wmic.exe
Token: SeManageVolumePrivilege	2972	wmic.exe
Token: 33	2972	wmic.exe
Token: 34	2972	wmic.exe
Token: 35	2972	wmic.exe
Token: SeIncreaseQuotaPrivilege	2532	wmic.exe
Token: SeSecurityPrivilege	2532	wmic.exe
Token: SeTakeOwnershipPrivilege	2532	wmic.exe
Token: SeLoadDriverPrivilege	2532	wmic.exe
Token: SeSystemProfilePrivilege	2532	wmic.exe
Token: SeSystemtimePrivilege	2532	wmic.exe
Token: SeProfSingleProcessPrivilege	2532	wmic.exe
Token: SeIncBasePriorityPrivilege	2532	wmic.exe
Token: SeCreatePagefilePrivilege	2532	wmic.exe
Token: SeBackupPrivilege	2532	wmic.exe
Token: SeRestorePrivilege	2532	wmic.exe
Token: SeShutdownPrivilege	2532	wmic.exe
Token: SeDebugPrivilege	2532	wmic.exe
Token: SeSystemEnvironmentPrivilege	2532	wmic.exe
Token: SeRemoteShutdownPrivilege	2532	wmic.exe
Token: SeUndockPrivilege	2532	wmic.exe
Token: SeManageVolumePrivilege	2532	wmic.exe
Token: 33	2532	wmic.exe
Token: 34	2532	wmic.exe
Token: 35	2532	wmic.exe
Token: SeIncreaseQuotaPrivilege	2504	wmic.exe
Token: SeSecurityPrivilege	2504	wmic.exe
Token: SeTakeOwnershipPrivilege	2504	wmic.exe
Token: SeLoadDriverPrivilege	2504	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exebeeiehibdh.exe

description	pid	process	target process
PID 2204 wrote to memory of 2872	2204	657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe	beeiehibdh.exe
PID 2204 wrote to memory of 2872	2204	657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe	beeiehibdh.exe
PID 2204 wrote to memory of 2872	2204	657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe	beeiehibdh.exe
PID 2204 wrote to memory of 2872	2204	657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe	beeiehibdh.exe
PID 2872 wrote to memory of 2972	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2972	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2972	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2972	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2532	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2532	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2532	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2532	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2504	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2504	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2504	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2504	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2528	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2528	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2528	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2528	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2444	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2444	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2444	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 2444	2872	beeiehibdh.exe	wmic.exe
PID 2872 wrote to memory of 3012	2872	beeiehibdh.exe	WerFault.exe
PID 2872 wrote to memory of 3012	2872	beeiehibdh.exe	WerFault.exe
PID 2872 wrote to memory of 3012	2872	beeiehibdh.exe	WerFault.exe
PID 2872 wrote to memory of 3012	2872	beeiehibdh.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\657bc9cd9affb2bf02fcdcff2a71b7d2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\beeiehibdh.exe
C:\Users\Admin\AppData\Local\Temp\beeiehibdh.exe 5!0!6!2!2!6!0!3!2!5!8 KlBDQjsqICxRUDpLST47LhovS0NPT0pSRUdCNzAdLT9BTlRDQjsqICxBRDw4MBotTkxPQVM+TFpJPjsuGi9QQ01OQFJZU1BGPWVyb2g1LylxcHAuQUNOQyhUSU4rO1BNLERGQU8aLUFGSUBJRDw4IClCLzctLh4qPC09Jy8eKUQwOygpGy8+MjsnMR0tPy04LSseLUpSTEJQO09fSlBHUEFAVzgYKlBMTUJPQ1FdQE1HQTceLUpSTEJQO09fSD9LPz0dLUBQQF9PUEo3ICxDUz1aQ0dCSkNOQjsbJ0NPTVJdPFJMVU49TT0vHi1OSD5MRlFKVVlTUEY9HS1RRTgyGi1CTTE6HipKUE5OR0s/X1RDRztKTT9HSztHQlNNRDggKUdRWVJSTE9BSEU3cnBvZR0tTT1PVUxMR0hHXFNOPU1fPj9XTT0vHipAREQ/VjsrICxHTlc/WUg/S0NDXENJO01ZSlJDPj1jX2drYCApQk1RTklNPDxaSUo7MCo4Ky8sKCk5LSwvLDIdLUs5TUFGSkNGX0ZMTkw8TEY7cmx1Yh4qTERNPzsvLjQ1MjMqMDMuHi0+T1RMR0c8RFlSR0dFOi8sJy01KTAuKzUnNjUpMDotMihKTQ==
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716340516.txt bios get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716340516.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716340516.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716340516.txt bios get version
3⤵
PID:2528

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716340516.txt bios get version
3⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 368
3⤵
- Loads dropped DLL
- Program crash
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716340516.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\beeiehibdh.exe

Filesize
538KB

MD5
9ea77f6dcce94375a970d3c88a858d35

SHA1
9169860b2c4cae83db68e2df745cb904961acc98

SHA256
2291ef3611c5a92a59ae38da36dfdc60b0487cb54ea17e12c9a396d9ef6e4eed

SHA512
ae549b7f76d70dcde205a342852cbbe00f46477e3982c5b363c96b016781886c8fd908250fc231dd7ae97a10b94561b6184576201f2bbb02685a129d02b9c011

Download Submit

Analysis

Sharing