4df06fd17571b1ade49b0bff3ea0ac0ef237bacc79780393bcdad9ae820abbdc

General

Target

6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe
Size

71KB
MD5

6915ce5700338b8cd322dadf378f76f3
SHA1

b08aca61c8be55e858573724a871e61489f2eb53
SHA256

4df06fd17571b1ade49b0bff3ea0ac0ef237bacc79780393bcdad9ae820abbdc
SHA512

ff5a058045ea41dcc64cab140396f56a58056f6be0505a319ca0e34031fea4298a291356898ade75813ce461f7ad3a6520bff8b1db1f3a76012966fb7426bd82
SSDEEP

1536:Ma5jUXUo7VWSzYoVQtNnKq4/BAW+Et/mbGtFH204jb+:t5jUXU+VQPnlEt604jb+

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4224 netsh.exe

pid	process
4224	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe

Drops startup file 2 IoCs

Processes:

server.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\74e9eceb82f08f900ec2d0614c81cfb5.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\74e9eceb82f08f900ec2d0614c81cfb5.exe	server.exe

Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

2256 server.exe

pid	process
2256	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74e9eceb82f08f900ec2d0614c81cfb5 = "\"C:\\Windows\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74e9eceb82f08f900ec2d0614c81cfb5 = "\"C:\\Windows\\server.exe\" .."	server.exe

Drops file in Windows directory 2 IoCs

Processes:

6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exeserver.exe

description	ioc	process
File created	C:\Windows\server.exe	6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe
File opened for modification	C:\Windows\server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe
Token: 33	2256	server.exe
Token: SeIncBasePriorityPrivilege	2256	server.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exeserver.exe

description	pid	process	target process
PID 1520 wrote to memory of 2256	1520	6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe	server.exe
PID 1520 wrote to memory of 2256	1520	6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe	server.exe
PID 2256 wrote to memory of 4224	2256	server.exe	netsh.exe
PID 2256 wrote to memory of 4224	2256	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6915ce5700338b8cd322dadf378f76f3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\server.exe
"C:\Windows\server.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4224

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\server.exe
Filesize
71KB

MD5
6915ce5700338b8cd322dadf378f76f3

SHA1
b08aca61c8be55e858573724a871e61489f2eb53

SHA256
4df06fd17571b1ade49b0bff3ea0ac0ef237bacc79780393bcdad9ae820abbdc

SHA512
ff5a058045ea41dcc64cab140396f56a58056f6be0505a319ca0e34031fea4298a291356898ade75813ce461f7ad3a6520bff8b1db1f3a76012966fb7426bd82

Download Submit
memory/1520-3-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/1520-2-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/1520-0-0x00007FF99AE25000-0x00007FF99AE26000-memory.dmp

Filesize
4KB

Download
memory/1520-4-0x0000000001750000-0x000000000175E000-memory.dmp

Filesize
56KB

Download
memory/1520-5-0x000000001CB50000-0x000000001D01E000-memory.dmp

Filesize
4.8MB

Download
memory/1520-1-0x000000001BED0000-0x000000001BF76000-memory.dmp

Filesize
664KB

Download
memory/1520-18-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/2256-19-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/2256-20-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/2256-23-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/2256-24-0x000000001D210000-0x000000001D2AC000-memory.dmp

Filesize
624KB

Download
memory/2256-25-0x0000000001080000-0x0000000001088000-memory.dmp

Filesize
32KB

Download
memory/2256-27-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download
memory/2256-29-0x00007FF99AB70000-0x00007FF99B511000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads