dfaf453128b23d5e02788dc300dea344f284d89a333f4f320861f823b531960c

General

Target

6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe
Size

489KB
MD5

6598ad85d5f6a015c187c3a3416374db
SHA1

bc2d9aa6da5ec83df33c3efb231e8ad557eb17f0
SHA256

dfaf453128b23d5e02788dc300dea344f284d89a333f4f320861f823b531960c
SHA512

9c01527aa36d523b44c29957ed12732e9d9a4f05855556617c615a98db6d468f2fbcca62018cfa520c45634ff870725ee44838273e6cad69c5b11f2330bf91d1
SSDEEP

12288:nWH9eJdz+oBqiOMsKns/Op7NWBStqWjGJ7VE:nWdIdzz0imR/M7UBCjAE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

befageijdg_P.exe

pid process

2300 befageijdg_P.exe
Loads dropped DLL 2 IoCs

Processes:

6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe

pid process

1712 6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe
1712 6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2300	befageijdg_P.exe

pid	process
1712	6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe
1712	6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2984	wmic.exe
Token: SeSecurityPrivilege	2984	wmic.exe
Token: SeTakeOwnershipPrivilege	2984	wmic.exe
Token: SeLoadDriverPrivilege	2984	wmic.exe
Token: SeSystemProfilePrivilege	2984	wmic.exe
Token: SeSystemtimePrivilege	2984	wmic.exe
Token: SeProfSingleProcessPrivilege	2984	wmic.exe
Token: SeIncBasePriorityPrivilege	2984	wmic.exe
Token: SeCreatePagefilePrivilege	2984	wmic.exe
Token: SeBackupPrivilege	2984	wmic.exe
Token: SeRestorePrivilege	2984	wmic.exe
Token: SeShutdownPrivilege	2984	wmic.exe
Token: SeDebugPrivilege	2984	wmic.exe
Token: SeSystemEnvironmentPrivilege	2984	wmic.exe
Token: SeRemoteShutdownPrivilege	2984	wmic.exe
Token: SeUndockPrivilege	2984	wmic.exe
Token: SeManageVolumePrivilege	2984	wmic.exe
Token: 33	2984	wmic.exe
Token: 34	2984	wmic.exe
Token: 35	2984	wmic.exe
Token: SeIncreaseQuotaPrivilege	2984	wmic.exe
Token: SeSecurityPrivilege	2984	wmic.exe
Token: SeTakeOwnershipPrivilege	2984	wmic.exe
Token: SeLoadDriverPrivilege	2984	wmic.exe
Token: SeSystemProfilePrivilege	2984	wmic.exe
Token: SeSystemtimePrivilege	2984	wmic.exe
Token: SeProfSingleProcessPrivilege	2984	wmic.exe
Token: SeIncBasePriorityPrivilege	2984	wmic.exe
Token: SeCreatePagefilePrivilege	2984	wmic.exe
Token: SeBackupPrivilege	2984	wmic.exe
Token: SeRestorePrivilege	2984	wmic.exe
Token: SeShutdownPrivilege	2984	wmic.exe
Token: SeDebugPrivilege	2984	wmic.exe
Token: SeSystemEnvironmentPrivilege	2984	wmic.exe
Token: SeRemoteShutdownPrivilege	2984	wmic.exe
Token: SeUndockPrivilege	2984	wmic.exe
Token: SeManageVolumePrivilege	2984	wmic.exe
Token: 33	2984	wmic.exe
Token: 34	2984	wmic.exe
Token: 35	2984	wmic.exe
Token: SeIncreaseQuotaPrivilege	2604	wmic.exe
Token: SeSecurityPrivilege	2604	wmic.exe
Token: SeTakeOwnershipPrivilege	2604	wmic.exe
Token: SeLoadDriverPrivilege	2604	wmic.exe
Token: SeSystemProfilePrivilege	2604	wmic.exe
Token: SeSystemtimePrivilege	2604	wmic.exe
Token: SeProfSingleProcessPrivilege	2604	wmic.exe
Token: SeIncBasePriorityPrivilege	2604	wmic.exe
Token: SeCreatePagefilePrivilege	2604	wmic.exe
Token: SeBackupPrivilege	2604	wmic.exe
Token: SeRestorePrivilege	2604	wmic.exe
Token: SeShutdownPrivilege	2604	wmic.exe
Token: SeDebugPrivilege	2604	wmic.exe
Token: SeSystemEnvironmentPrivilege	2604	wmic.exe
Token: SeRemoteShutdownPrivilege	2604	wmic.exe
Token: SeUndockPrivilege	2604	wmic.exe
Token: SeManageVolumePrivilege	2604	wmic.exe
Token: 33	2604	wmic.exe
Token: 34	2604	wmic.exe
Token: 35	2604	wmic.exe
Token: SeIncreaseQuotaPrivilege	2660	wmic.exe
Token: SeSecurityPrivilege	2660	wmic.exe
Token: SeTakeOwnershipPrivilege	2660	wmic.exe
Token: SeLoadDriverPrivilege	2660	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exebefageijdg_P.exe

description	pid	process	target process
PID 1712 wrote to memory of 2300	1712	6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe	befageijdg_P.exe
PID 1712 wrote to memory of 2300	1712	6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe	befageijdg_P.exe
PID 1712 wrote to memory of 2300	1712	6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe	befageijdg_P.exe
PID 1712 wrote to memory of 2300	1712	6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe	befageijdg_P.exe
PID 2300 wrote to memory of 2984	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2984	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2984	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2984	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2604	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2604	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2604	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2604	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2660	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2660	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2660	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2660	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2560	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2560	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2560	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2560	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2312	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2312	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2312	2300	befageijdg_P.exe	wmic.exe
PID 2300 wrote to memory of 2312	2300	befageijdg_P.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6598ad85d5f6a015c187c3a3416374db_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\befageijdg_P.exe
C:\Users\Admin\AppData\Local\Temp\befageijdg_P.exe 0!0!1!5!1!4!0!0!0!1!8 L1BIPzwuMzMyNhgvU1Q9T0VEPTAfJ05FU1JOTktJRDwpIC9DRFJQSUQ9MTE3Ni8bLj9JRD0vGC9QUUpDUUNUX0g8PTI4Ky8sIC9TREpWRVFaVE5MPWhzbHA6LipybnYuRERLSy1TSk8pQVBQLUFORk4bLj9MSUNKQUQ9NGNjQ29zNUFmbjJsYTIwbTBNcl04LWFjTC5MTk5CUVJnMC5EPXN2SjYoejgsaUlQU0YyL1lOY0RybF9VVGtsQ0J5RXIzc0lFVmZGSGtJPm5TS3dES1BlaWsyXlVlaUN5RmxKamRoR2dDWS88czN3VGVMIC9EMDUtMR8qQy49LTEfJ0QzPCgwHC9ENDwlMSAuPzQ5LTEgLkhST0NQQlBfUFJITkFDWDgfK1BST0NNQ1ReQFRIQT0gLkhST0NQQlBfTkFMPT1vbWdoamVzaG5oaW5mKXllcCAvRFBFX1RNSzkke1VRRH0gLkBXQV9DTUNESU5EOB8rSE9TU1dCUk5SUkFSPTUfJ1RIQElKVU9VX1RKTD0fKlVJPTIgLjxTMTwtODQgL1JURlRJTEBeU0VMQ05FRUlMPEZBVVJMPBgvSVJaUVFOVElMPT10cXBkHC9SRVNNUk5ISUZbVVNFUVdEQVhOPC4gL0hIPEVYPCwfK0lTX0NRTkFMREJbRU5DUVFQVEQ/PGJhbHNkGC9ETlJNSE9BRF5BUD0xKzcqMTEwLTEzLjAtMRwvUEFROUxMREdeRU5TVEBETD1zbXRhIC9USEVFPTAvNCw2NTg0KzEgLj9OU05MT0A8X1RISEQ5MTIvMSkvMi8sNCYxMjozKjoxMCVASQ==
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716342844.txt bios get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716342844.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716342844.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716342844.txt bios get version
3⤵
PID:2560

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716342844.txt bios get version
3⤵
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716342844.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\befageijdg_P.exe

Filesize
674KB

MD5
760020ca394bcf52141a3ac60ef4f7b2

SHA1
413fdf56aaa531d255b96a06d082571aba17671e

SHA256
e664027cfeef798cc638c9bb7a8e99f1da384bed25c69eb54f6c9e755aad6052

SHA512
1bd1b4424f0e582a63a2796b44b9a6dc3ab754f145d4a1dff0b5684d14a86f2fe524a62dd40858ca6e3e9d894aa9ca7c0eae768a1ed81ca6cc1656f8e4993cd3

Download Submit
memory/2300-8-0x0000000074FB1000-0x0000000074FB2000-memory.dmp

Filesize
4KB

Download
memory/2300-9-0x0000000074FA0000-0x00000000750B0000-memory.dmp

Filesize
1.1MB

Download
memory/2300-16-0x00000000002E0000-0x0000000000383000-memory.dmp

Filesize
652KB

Download
memory/2300-18-0x0000000074FA0000-0x00000000750B0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing