1630e885d4a9ba87cc53c88f109832e2521b4603650199dbd2e47e8249de4e46

General

Target

65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
Size

574KB
MD5

65e16ac41e6444238fab1da536e9d076
SHA1

4d0a1423a0f9a81c62b374edd35456b90e5fc056
SHA256

1630e885d4a9ba87cc53c88f109832e2521b4603650199dbd2e47e8249de4e46
SHA512

1ad2dcc3a07abf172e9848775f926abfa1503eadc1733f7e593a6b8f1f0496cf1b63d993cd20db03cf123c9dc6792ebe7ae37c79f9e8f0134f69703657d4af91
SSDEEP

12288:8m6SjdbDhT2pju0jaiYJIsB+4aFZbjQh8cqHBvyxGr3xny:8uj1D4o0jaiuX+4aFZHQhKHBvy+xy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

bbcfcabebbbbb.exe

pid process

5052 bbcfcabebbbbb.exe
Loads dropped DLL 2 IoCs

Processes:

65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe

pid process

1736 65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
1736 65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1552 5052 WerFault.exe bbcfcabebbbbb.exe

pid	process
5052	bbcfcabebbbbb.exe

pid	process
1736	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
1736	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe

pid	pid_target	process	target process
1552	5052	WerFault.exe	bbcfcabebbbbb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2676	wmic.exe
Token: SeSecurityPrivilege	2676	wmic.exe
Token: SeTakeOwnershipPrivilege	2676	wmic.exe
Token: SeLoadDriverPrivilege	2676	wmic.exe
Token: SeSystemProfilePrivilege	2676	wmic.exe
Token: SeSystemtimePrivilege	2676	wmic.exe
Token: SeProfSingleProcessPrivilege	2676	wmic.exe
Token: SeIncBasePriorityPrivilege	2676	wmic.exe
Token: SeCreatePagefilePrivilege	2676	wmic.exe
Token: SeBackupPrivilege	2676	wmic.exe
Token: SeRestorePrivilege	2676	wmic.exe
Token: SeShutdownPrivilege	2676	wmic.exe
Token: SeDebugPrivilege	2676	wmic.exe
Token: SeSystemEnvironmentPrivilege	2676	wmic.exe
Token: SeRemoteShutdownPrivilege	2676	wmic.exe
Token: SeUndockPrivilege	2676	wmic.exe
Token: SeManageVolumePrivilege	2676	wmic.exe
Token: 33	2676	wmic.exe
Token: 34	2676	wmic.exe
Token: 35	2676	wmic.exe
Token: 36	2676	wmic.exe
Token: SeIncreaseQuotaPrivilege	2676	wmic.exe
Token: SeSecurityPrivilege	2676	wmic.exe
Token: SeTakeOwnershipPrivilege	2676	wmic.exe
Token: SeLoadDriverPrivilege	2676	wmic.exe
Token: SeSystemProfilePrivilege	2676	wmic.exe
Token: SeSystemtimePrivilege	2676	wmic.exe
Token: SeProfSingleProcessPrivilege	2676	wmic.exe
Token: SeIncBasePriorityPrivilege	2676	wmic.exe
Token: SeCreatePagefilePrivilege	2676	wmic.exe
Token: SeBackupPrivilege	2676	wmic.exe
Token: SeRestorePrivilege	2676	wmic.exe
Token: SeShutdownPrivilege	2676	wmic.exe
Token: SeDebugPrivilege	2676	wmic.exe
Token: SeSystemEnvironmentPrivilege	2676	wmic.exe
Token: SeRemoteShutdownPrivilege	2676	wmic.exe
Token: SeUndockPrivilege	2676	wmic.exe
Token: SeManageVolumePrivilege	2676	wmic.exe
Token: 33	2676	wmic.exe
Token: 34	2676	wmic.exe
Token: 35	2676	wmic.exe
Token: 36	2676	wmic.exe
Token: SeIncreaseQuotaPrivilege	3092	wmic.exe
Token: SeSecurityPrivilege	3092	wmic.exe
Token: SeTakeOwnershipPrivilege	3092	wmic.exe
Token: SeLoadDriverPrivilege	3092	wmic.exe
Token: SeSystemProfilePrivilege	3092	wmic.exe
Token: SeSystemtimePrivilege	3092	wmic.exe
Token: SeProfSingleProcessPrivilege	3092	wmic.exe
Token: SeIncBasePriorityPrivilege	3092	wmic.exe
Token: SeCreatePagefilePrivilege	3092	wmic.exe
Token: SeBackupPrivilege	3092	wmic.exe
Token: SeRestorePrivilege	3092	wmic.exe
Token: SeShutdownPrivilege	3092	wmic.exe
Token: SeDebugPrivilege	3092	wmic.exe
Token: SeSystemEnvironmentPrivilege	3092	wmic.exe
Token: SeRemoteShutdownPrivilege	3092	wmic.exe
Token: SeUndockPrivilege	3092	wmic.exe
Token: SeManageVolumePrivilege	3092	wmic.exe
Token: 33	3092	wmic.exe
Token: 34	3092	wmic.exe
Token: 35	3092	wmic.exe
Token: 36	3092	wmic.exe
Token: SeIncreaseQuotaPrivilege	3092	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exebbcfcabebbbbb.exe

description	pid	process	target process
PID 1736 wrote to memory of 5052	1736	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 1736 wrote to memory of 5052	1736	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 1736 wrote to memory of 5052	1736	65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe	bbcfcabebbbbb.exe
PID 5052 wrote to memory of 2676	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 2676	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 2676	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 3092	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 3092	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 3092	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 2536	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 2536	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 2536	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 1872	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 1872	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 1872	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 4556	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 4556	5052	bbcfcabebbbbb.exe	wmic.exe
PID 5052 wrote to memory of 4556	5052	bbcfcabebbbbb.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65e16ac41e6444238fab1da536e9d076_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\bbcfcabebbbbb.exe
C:\Users\Admin\AppData\Local\Temp\bbcfcabebbbbb.exe /PID=2777 /SUBPID=0 /NETWORKID=0 /DISTID=24601 /CID=0 /PRODUCT_ID=1694 /SERVER_URL=`omn7).enqoYgeco(oldmrfgh_a(bkm /CLICKID=1003691031416881198 /D1=1 /D2=-1 /D3=-1 /D4=-1 /D5=-1 /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1416881199 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /HIDEX=1 /IS_DYNAMIC_ENCRYPTED=true
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349193.txt bios get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349193.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349193.txt bios get version
3⤵
PID:2536

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349193.txt bios get version
3⤵
PID:1872

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716349193.txt bios get version
3⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 844
3⤵
- Program crash
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 5052
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716349193.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81716349193.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81716349193.txt

Filesize
58B

MD5
f8e2f71e123c5a848f2a83d2a7aef11e

SHA1
5e7a9a2937fa4f06fdf3e33d7def7de431c159b4

SHA256
79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121

SHA512
8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbcfcabebbbbb.exe

Filesize
810KB

MD5
4c7e4732fc793b39cff476f95e06577c

SHA1
afd9b263848ce98f62cf4580fcbb871c241f6006

SHA256
359e95ded51918aa3be651b45b01c841eb4d02d20fa352321044c570f34fd0f9

SHA512
d944c7155550dda24de8b338b3cbc140b8c0b24a5133fbd4cd3d1f1d9116bd3fdf48b26c1a72fc346b928509278f6da60f75599fd05d5f7829f698d70fa54649

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl89C2.tmp\okm.dll

Filesize
121KB

MD5
aabfcf8ab7a7e3ed904e3a9120307a97

SHA1
2267c746bae40071ad79590418f32903f9b249de

SHA256
6dc0194bfee51a0510e55c4dbe427694ab0da03f2c5c6f19537c835cb4a0d496

SHA512
78d5843f748af65ea4afe2eab5184bfff53e1bba232326b45ab701efa59aab8c81c52cceb4be2498ace8edf51302844a3a66a1e97018082192c0cb528a276a1d

Download Submit

Analysis

Sharing