1630e885d4a9ba87cc53c88f109832e2521b4603650199dbd2e47e8249de4e46

General

Target

65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
Size

574KB
MD5

65e16ac41e6444238fab1da536e9d076
SHA1

4d0a1423a0f9a81c62b374edd35456b90e5fc056
SHA256

1630e885d4a9ba87cc53c88f109832e2521b4603650199dbd2e47e8249de4e46
SHA512

1ad2dcc3a07abf172e9848775f926abfa1503eadc1733f7e593a6b8f1f0496cf1b63d993cd20db03cf123c9dc6792ebe7ae37c79f9e8f0134f69703657d4af91
SSDEEP

12288:8m6SjdbDhT2pju0jaiYJIsB+4aFZbjQh8cqHBvyxGr3xny:8uj1D4o0jaiuX+4aFZHQhKHBvy+xy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

bbcfcabebbbbb.exe

pid process

2364 bbcfcabebbbbb.exe

pid	process
2364	bbcfcabebbbbb.exe

Loads dropped DLL 10 IoCs

Processes:

65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exeWerFault.exe

pid	process
2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe
3024	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3024 2364 WerFault.exe bbcfcabebbbbb.exe

pid	pid_target	process	target process
3024	2364	WerFault.exe	bbcfcabebbbbb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2924	wmic.exe
Token: SeSecurityPrivilege	2924	wmic.exe
Token: SeTakeOwnershipPrivilege	2924	wmic.exe
Token: SeLoadDriverPrivilege	2924	wmic.exe
Token: SeSystemProfilePrivilege	2924	wmic.exe
Token: SeSystemtimePrivilege	2924	wmic.exe
Token: SeProfSingleProcessPrivilege	2924	wmic.exe
Token: SeIncBasePriorityPrivilege	2924	wmic.exe
Token: SeCreatePagefilePrivilege	2924	wmic.exe
Token: SeBackupPrivilege	2924	wmic.exe
Token: SeRestorePrivilege	2924	wmic.exe
Token: SeShutdownPrivilege	2924	wmic.exe
Token: SeDebugPrivilege	2924	wmic.exe
Token: SeSystemEnvironmentPrivilege	2924	wmic.exe
Token: SeRemoteShutdownPrivilege	2924	wmic.exe
Token: SeUndockPrivilege	2924	wmic.exe
Token: SeManageVolumePrivilege	2924	wmic.exe
Token: 33	2924	wmic.exe
Token: 34	2924	wmic.exe
Token: 35	2924	wmic.exe
Token: SeIncreaseQuotaPrivilege	2924	wmic.exe
Token: SeSecurityPrivilege	2924	wmic.exe
Token: SeTakeOwnershipPrivilege	2924	wmic.exe
Token: SeLoadDriverPrivilege	2924	wmic.exe
Token: SeSystemProfilePrivilege	2924	wmic.exe
Token: SeSystemtimePrivilege	2924	wmic.exe
Token: SeProfSingleProcessPrivilege	2924	wmic.exe
Token: SeIncBasePriorityPrivilege	2924	wmic.exe
Token: SeCreatePagefilePrivilege	2924	wmic.exe
Token: SeBackupPrivilege	2924	wmic.exe
Token: SeRestorePrivilege	2924	wmic.exe
Token: SeShutdownPrivilege	2924	wmic.exe
Token: SeDebugPrivilege	2924	wmic.exe
Token: SeSystemEnvironmentPrivilege	2924	wmic.exe
Token: SeRemoteShutdownPrivilege	2924	wmic.exe
Token: SeUndockPrivilege	2924	wmic.exe
Token: SeManageVolumePrivilege	2924	wmic.exe
Token: 33	2924	wmic.exe
Token: 34	2924	wmic.exe
Token: 35	2924	wmic.exe
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe
Token: SeSecurityPrivilege	2804	wmic.exe
Token: SeTakeOwnershipPrivilege	2804	wmic.exe
Token: SeLoadDriverPrivilege	2804	wmic.exe
Token: SeSystemProfilePrivilege	2804	wmic.exe
Token: SeSystemtimePrivilege	2804	wmic.exe
Token: SeProfSingleProcessPrivilege	2804	wmic.exe
Token: SeIncBasePriorityPrivilege	2804	wmic.exe
Token: SeCreatePagefilePrivilege	2804	wmic.exe
Token: SeBackupPrivilege	2804	wmic.exe
Token: SeRestorePrivilege	2804	wmic.exe
Token: SeShutdownPrivilege	2804	wmic.exe
Token: SeDebugPrivilege	2804	wmic.exe
Token: SeSystemEnvironmentPrivilege	2804	wmic.exe
Token: SeRemoteShutdownPrivilege	2804	wmic.exe
Token: SeUndockPrivilege	2804	wmic.exe
Token: SeManageVolumePrivilege	2804	wmic.exe
Token: 33	2804	wmic.exe
Token: 34	2804	wmic.exe
Token: 35	2804	wmic.exe
Token: SeIncreaseQuotaPrivilege	2608	wmic.exe
Token: SeSecurityPrivilege	2608	wmic.exe
Token: SeTakeOwnershipPrivilege	2608	wmic.exe
Token: SeLoadDriverPrivilege	2608	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exebbcfcabebbbbb.exe

description	pid	process	target process
PID 2436 wrote to memory of 2364	2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 2436 wrote to memory of 2364	2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 2436 wrote to memory of 2364	2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 2436 wrote to memory of 2364	2436	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 2364 wrote to memory of 2924	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2924	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2924	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2924	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2804	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2804	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2804	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2804	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2608	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2608	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2608	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2608	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2800	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2800	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2800	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2800	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2580	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2580	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2580	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 2580	2364	bbcfcabebbbbb.exe	wmic.exe
PID 2364 wrote to memory of 3024	2364	bbcfcabebbbbb.exe	WerFault.exe
PID 2364 wrote to memory of 3024	2364	bbcfcabebbbbb.exe	WerFault.exe
PID 2364 wrote to memory of 3024	2364	bbcfcabebbbbb.exe	WerFault.exe
PID 2364 wrote to memory of 3024	2364	bbcfcabebbbbb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\bbcfcabebbbbb.exe
C:\Users\Admin\AppData\Local\Temp\bbcfcabebbbbb.exe /PID=2777 /SUBPID=0 /NETWORKID=0 /DISTID=24601 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=`omn7).enqoYgeco(oldmrfgh_a(bkm /CLICKID=1003691031416881198 /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1416881199 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /HIDEX=1 /IS_DYNAMIC_ENCRYPTED=true
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349192.txt bios get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349192.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349192.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349192.txt bios get version
3⤵
PID:2800

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349192.txt bios get version
3⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 372
3⤵
- Loads dropped DLL
- Program crash
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716349192.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\bbcfcabebbbbb.exe

Filesize
810KB

MD5
4c7e4732fc793b39cff476f95e06577c

SHA1
afd9b263848ce98f62cf4580fcbb871c241f6006

SHA256
359e95ded51918aa3be651b45b01c841eb4d02d20fa352321044c570f34fd0f9

SHA512
d944c7155550dda24de8b338b3cbc140b8c0b24a5133fbd4cd3d1f1d9116bd3fdf48b26c1a72fc346b928509278f6da60f75599fd05d5f7829f698d70fa54649

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1324.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1324.tmp\okm.dll

Filesize
121KB

MD5
aabfcf8ab7a7e3ed904e3a9120307a97

SHA1
2267c746bae40071ad79590418f32903f9b249de

SHA256
6dc0194bfee51a0510e55c4dbe427694ab0da03f2c5c6f19537c835cb4a0d496

SHA512
78d5843f748af65ea4afe2eab5184bfff53e1bba232326b45ab701efa59aab8c81c52cceb4be2498ace8edf51302844a3a66a1e97018082192c0cb528a276a1d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads