4011ef06c8ab767c62a56b8f90bcda475485ef2a4199ea1dae324d13b4ade5d2

General

Target

688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
Size

488KB
MD5

688b4e8b6a193a1ac67311491a3ce2a6
SHA1

90b224073e4051d2e904c3adad205a2b76bf9682
SHA256

4011ef06c8ab767c62a56b8f90bcda475485ef2a4199ea1dae324d13b4ade5d2
SHA512

ec0d503c7f99b0ffb33ea0b940a8ee11d7e13a07bb7a2b6e95ccf9c93a51cd74ef0c843fc35919a42706f31c9bdc8586429be078b44c7832c3e3e58998da4cd9
SSDEEP

6144:aFJ0PiJ5lAmVzjRmfcRB5edIMsnIzmw/nGWiYjXvhFuzj+h7DJL5qZ4Z+3pZ2ydy:xi2cRXYJzm4nGWXLvLufCxA3p1dy77T

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

befacajhdg_P.exe

pid process

1444 befacajhdg_P.exe
Loads dropped DLL 2 IoCs

Processes:

688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe

pid process

2412 688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
2412 688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1444	befacajhdg_P.exe

pid	process
2412	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
2412	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2596	wmic.exe
Token: SeSecurityPrivilege	2596	wmic.exe
Token: SeTakeOwnershipPrivilege	2596	wmic.exe
Token: SeLoadDriverPrivilege	2596	wmic.exe
Token: SeSystemProfilePrivilege	2596	wmic.exe
Token: SeSystemtimePrivilege	2596	wmic.exe
Token: SeProfSingleProcessPrivilege	2596	wmic.exe
Token: SeIncBasePriorityPrivilege	2596	wmic.exe
Token: SeCreatePagefilePrivilege	2596	wmic.exe
Token: SeBackupPrivilege	2596	wmic.exe
Token: SeRestorePrivilege	2596	wmic.exe
Token: SeShutdownPrivilege	2596	wmic.exe
Token: SeDebugPrivilege	2596	wmic.exe
Token: SeSystemEnvironmentPrivilege	2596	wmic.exe
Token: SeRemoteShutdownPrivilege	2596	wmic.exe
Token: SeUndockPrivilege	2596	wmic.exe
Token: SeManageVolumePrivilege	2596	wmic.exe
Token: 33	2596	wmic.exe
Token: 34	2596	wmic.exe
Token: 35	2596	wmic.exe
Token: SeIncreaseQuotaPrivilege	2596	wmic.exe
Token: SeSecurityPrivilege	2596	wmic.exe
Token: SeTakeOwnershipPrivilege	2596	wmic.exe
Token: SeLoadDriverPrivilege	2596	wmic.exe
Token: SeSystemProfilePrivilege	2596	wmic.exe
Token: SeSystemtimePrivilege	2596	wmic.exe
Token: SeProfSingleProcessPrivilege	2596	wmic.exe
Token: SeIncBasePriorityPrivilege	2596	wmic.exe
Token: SeCreatePagefilePrivilege	2596	wmic.exe
Token: SeBackupPrivilege	2596	wmic.exe
Token: SeRestorePrivilege	2596	wmic.exe
Token: SeShutdownPrivilege	2596	wmic.exe
Token: SeDebugPrivilege	2596	wmic.exe
Token: SeSystemEnvironmentPrivilege	2596	wmic.exe
Token: SeRemoteShutdownPrivilege	2596	wmic.exe
Token: SeUndockPrivilege	2596	wmic.exe
Token: SeManageVolumePrivilege	2596	wmic.exe
Token: 33	2596	wmic.exe
Token: 34	2596	wmic.exe
Token: 35	2596	wmic.exe
Token: SeIncreaseQuotaPrivilege	2176	wmic.exe
Token: SeSecurityPrivilege	2176	wmic.exe
Token: SeTakeOwnershipPrivilege	2176	wmic.exe
Token: SeLoadDriverPrivilege	2176	wmic.exe
Token: SeSystemProfilePrivilege	2176	wmic.exe
Token: SeSystemtimePrivilege	2176	wmic.exe
Token: SeProfSingleProcessPrivilege	2176	wmic.exe
Token: SeIncBasePriorityPrivilege	2176	wmic.exe
Token: SeCreatePagefilePrivilege	2176	wmic.exe
Token: SeBackupPrivilege	2176	wmic.exe
Token: SeRestorePrivilege	2176	wmic.exe
Token: SeShutdownPrivilege	2176	wmic.exe
Token: SeDebugPrivilege	2176	wmic.exe
Token: SeSystemEnvironmentPrivilege	2176	wmic.exe
Token: SeRemoteShutdownPrivilege	2176	wmic.exe
Token: SeUndockPrivilege	2176	wmic.exe
Token: SeManageVolumePrivilege	2176	wmic.exe
Token: 33	2176	wmic.exe
Token: 34	2176	wmic.exe
Token: 35	2176	wmic.exe
Token: SeIncreaseQuotaPrivilege	2492	wmic.exe
Token: SeSecurityPrivilege	2492	wmic.exe
Token: SeTakeOwnershipPrivilege	2492	wmic.exe
Token: SeLoadDriverPrivilege	2492	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exebefacajhdg_P.exe

description	pid	process	target process
PID 2412 wrote to memory of 1444	2412	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe
PID 2412 wrote to memory of 1444	2412	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe
PID 2412 wrote to memory of 1444	2412	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe
PID 2412 wrote to memory of 1444	2412	688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe	befacajhdg_P.exe
PID 1444 wrote to memory of 2596	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2596	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2596	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2596	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2176	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2176	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2176	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2176	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2492	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2492	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2492	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2492	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2636	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2636	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2636	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2636	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2484	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2484	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2484	1444	befacajhdg_P.exe	wmic.exe
PID 1444 wrote to memory of 2484	1444	befacajhdg_P.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\688b4e8b6a193a1ac67311491a3ce2a6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe
C:\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe 4!0!6!1!1!6!7!7!5!9!7 K1BDQzwrMjEvKRkrU09BT0M9NisXKEpFTlZOTERCPzQpHC8+SFJOQj04JxkrQ0NDPCoZKEtJSEBVPVNeQz02KxcoT0VMVURMWE5NQzZkdG5vOSkobG1tJ0BFTUosTkhJKDhJTC5DTUVJGSg+Q0I/S0NDPBooPSw0Ji0gKUMxNyYqGyY9Lz0nMB8pPS04JCocLz40PCcqGSpHS0tET0JTWUlLRE06P1k3Hy5KS0g/TDxQXz9USzs2GSpHS0tET0JTWUc6SDw2HC8/V0RZTktHNBkrRVJEXj1GPUdAR0E9Gi5HSUxNWjlLS1dNRFE3LhkqS0E9TkVYTk9YTk1DNhwvUEw8LBkoP0oqOSApUVRITUJIPFhTRUZCTkc+Qkg4QEFVTEs8GihCTlZLUU5OSEw/Nm1tbF4cL0xEU09LR0RFQFtVTURRWT06VEo2LiApR0g+PlE4KBkrSU1eQ1NHOkhAPFtFSEJRU0lNQDs2YmFmcmQaKD1KTkdITztDXkNJNi0nMSoxKy8tMywnLCkrHC9KQFE7RUVAQ1hFTk1TQEZFNm9pbmEgKVNIRz42LCsuLDIuMjIqLhkqO0hTTkZOQD5YTUREPjkxLC4wMCgrKyguJjU0MTA0LS4lOEY=
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716410209.txt bios get serialnumber
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716410209.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716410209.txt bios get version
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716410209.txt bios get version
3⤵
PID:2636

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic /output:C:\Users\Admin\AppData\Local\Temp\81716410209.txt bios get version
3⤵
PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716410209.txt
Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\befacajhdg_P.exe
Filesize
674KB

MD5
fa589ac7920c04eff43238d6cd6068ec

SHA1
3a3896dbf780c8af638d2fb47b8c6f6d877b293c

SHA256
e150aac75f5a442eefca075cc815e7baa1ade1a4559834e0f643ccc6baceda1f

SHA512
b251f959de836c768b7eb35c5f5d7128bd490015da09039f2131fda73b343aa0b586a6f97cd622bf9f57627987c21661b619087b89ccf3c4c5e88add3f5be0be

Download Submit
memory/1444-8-0x0000000074BD1000-0x0000000074BD2000-memory.dmp

Filesize
4KB

Download
memory/1444-9-0x0000000074BC0000-0x0000000074CD0000-memory.dmp

Filesize
1.1MB

Download
memory/1444-16-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1444-18-0x0000000074BC0000-0x0000000074CD0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing