657fbc690fe57f1a1bb681b0193088f846845f7187ad90b0609190bbe946fd82

General

Target

65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Size

1.8MB
MD5

65d0dc166775c9b48e3f6b6154b4d501
SHA1

642c4843a011859d9bd75de5ff912a42f440c228
SHA256

657fbc690fe57f1a1bb681b0193088f846845f7187ad90b0609190bbe946fd82
SHA512

f1811ea679b1af932d1dceaea4592003f0a753660758023efd987c263cd2e26974ae744917c49c1e0f14a98130258a06f1583bef8b7290837da15ee8151213ac
SSDEEP

12288:E6by5EkGX0Szdmf16ch5uPWn89brpPU0c+/4FreyEJbmP1Y8eqvbQMnI4MZtMuMu:E6m5EXzzQf16ZPT9/ItbhYez3M7O3Ar

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe

description pid process

Token: SeLoadDriverPrivilege 4768 65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe

description	pid	process
Token: SeLoadDriverPrivilege	4768	65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d0dc166775c9b48e3f6b6154b4d501_JaffaCakes118.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4768

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-0-0x0000000002A30000-0x0000000002BAC000-memory.dmp

Filesize
1.5MB

Download
memory/4768-2-0x0000000002A30000-0x0000000002BAC000-memory.dmp

Filesize
1.5MB

Download
memory/4768-3-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4768-4-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/4768-5-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/4768-6-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/4768-7-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/4768-8-0x0000000002A30000-0x0000000002BAC000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing