137b94cbc9fd3178ba03c4a5cb0177c487e8c4b3232e7baadb87e827185afedc

General

Target

99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe
Size

2.8MB
MD5

99979e33e7ec291f39c7302e51deffe8
SHA1

3f87309970c2f926d6047a8431f7c28d0f24b59e
SHA256

137b94cbc9fd3178ba03c4a5cb0177c487e8c4b3232e7baadb87e827185afedc
SHA512

18815372fa3eb328547122faab03d4a359e4c00225715744d4232f79a1d2937459cc1a559346fdc5debe38fc71b460b23841794b2b9b57af639d5c2b8ef10fa2
SSDEEP

49152:k9YQVrROcjFoGoMNNbvEq/XptVGueQnA89/NNVQa/nVpV2XLWBHLFHovJU/:uJVrROcpo7Gbvz/ZDNlNVQenVmWRL5qU

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp

Loads dropped DLL 5 IoCs

pid	Process
1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp
1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp
1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp
1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp
1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2916	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	powershell.exe
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1400	2452	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe	82
PID 2452 wrote to memory of 1400	2452	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe	82
PID 2452 wrote to memory of 1400	2452	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe	82
PID 1400 wrote to memory of 984	1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp	83
PID 1400 wrote to memory of 984	1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp	83
PID 1400 wrote to memory of 984	1400	99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp	83
PID 984 wrote to memory of 2916	984	cmd.exe	85
PID 984 wrote to memory of 2916	984	cmd.exe	85
PID 984 wrote to memory of 2916	984	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\is-TMJHF.tmp\99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TMJHF.tmp\99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp" /SL5="$B006E,2573572,143360,C:\Users\Admin\AppData\Local\Temp\99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-3L2J0.tmp\ex.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqptovg5.rmr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3L2J0.tmp\av.txt

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3L2J0.tmp\ex.bat

Filesize
786B

MD5
53ee5a05ef1ac4738be648b12e82a799

SHA1
cc3062c81594166f4a52ebd9ddec837da59ce35a

SHA256
b27697981252764038265557d370a6270a5cb232f9fb3f853a2d962471e0aa22

SHA512
2fc8d9d8e6d7b60768b10b3e8679008d5822733ccd395baf265762e315fdcbf5cd3dd8524b7fb9550dfeda2e98ba79d05e1c5c8f471786f2b3cecdfba20274e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3L2J0.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3L2J0.tmp\isskin.dll

Filesize
385KB

MD5
92c2e247392e0e02261dea67e1bb1a5e

SHA1
db72fed8771364bf8039b2bc83ed01dda2908554

SHA256
25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68

SHA512
e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3L2J0.tmp\itdownload.dll

Filesize
200KB

MD5
d82a429efd885ca0f324dd92afb6b7b8

SHA1
86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

SHA256
b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

SHA512
5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TMJHF.tmp\99979e33e7ec291f39c7302e51deffe8_JaffaCakes118.tmp

Filesize
776KB

MD5
69cfd0a4426e7c22178ce43933423877

SHA1
aca503edfe6a04b3be6a6229752307cfa173b46c

SHA256
520558c6fd09ba906540414482d0e8ad245d519b897e545557704b16d43eade4

SHA512
0b4daa8355492998a6ae29a1be39777998ed2c8f6b246c46c5ad665de3061d7823ab0ad57b8c4c260b7b4cf5f7e22914126f67891def8e9f96db89398455bb02

Download Submit
memory/1400-27-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Filesize
84KB

Download
memory/1400-20-0x0000000003B70000-0x0000000003BAC000-memory.dmp

Filesize
240KB

Download
memory/1400-63-0x0000000003B70000-0x0000000003BAC000-memory.dmp

Filesize
240KB

Download
memory/1400-64-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Filesize
84KB

Download
memory/1400-65-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1400-8-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2452-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2452-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2452-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2916-38-0x0000000005490000-0x00000000054F6000-memory.dmp

Filesize
408KB

Download
memory/2916-55-0x0000000007220000-0x00000000077C4000-memory.dmp

Filesize
5.6MB

Download
memory/2916-37-0x0000000004B60000-0x0000000004B82000-memory.dmp

Filesize
136KB

Download
memory/2916-49-0x0000000005570000-0x00000000058C4000-memory.dmp

Filesize
3.3MB

Download
memory/2916-50-0x0000000005B10000-0x0000000005B2E000-memory.dmp

Filesize
120KB

Download
memory/2916-51-0x0000000005B60000-0x0000000005BAC000-memory.dmp

Filesize
304KB

Download
memory/2916-52-0x0000000006BD0000-0x0000000006C66000-memory.dmp

Filesize
600KB

Download
memory/2916-53-0x0000000006030000-0x000000000604A000-memory.dmp

Filesize
104KB

Download
memory/2916-54-0x0000000006090000-0x00000000060B2000-memory.dmp

Filesize
136KB

Download
memory/2916-39-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/2916-56-0x0000000007E50000-0x00000000084CA000-memory.dmp

Filesize
6.5MB

Download
memory/2916-59-0x0000000073AA0000-0x0000000074250000-memory.dmp

Filesize
7.7MB

Download
memory/2916-36-0x0000000073AA0000-0x0000000074250000-memory.dmp

Filesize
7.7MB

Download
memory/2916-35-0x0000000004CF0000-0x0000000005318000-memory.dmp

Filesize
6.2MB

Download
memory/2916-34-0x0000000073AA0000-0x0000000074250000-memory.dmp

Filesize
7.7MB

Download
memory/2916-33-0x0000000002530000-0x0000000002566000-memory.dmp

Filesize
216KB

Download
memory/2916-32-0x0000000073AAE000-0x0000000073AAF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing