b1c086728237f60b8fc6b97c8fcace59659aeb1424d8ad71e1bf797555f96828

General

Target

99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe
Size

582KB
MD5

99a0b14c0a219367262cc6c78e66382b
SHA1

6e78fe1a7a133fb962cbfd3eac17a3fce00b6522
SHA256

b1c086728237f60b8fc6b97c8fcace59659aeb1424d8ad71e1bf797555f96828
SHA512

18786c5ca0721667f7f2522b4fd4f24483ed8fe63ca9790d60b28b878593b9d78bd1794ade039ba729302ec59a2e3b6f389b2f411de2d4bd38f5b3c3cee23d75
SSDEEP

12288:sWPkKiRhWkblntMXhnW8jxrBEdQTBN56rds:sfdhWkbV6BW8RKdQK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2756	bbhcabfcebdh.exe

Loads dropped DLL 2 IoCs

pid	Process
3504	99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe
3504	99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	2756	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4148	wmic.exe
Token: SeSecurityPrivilege	4148	wmic.exe
Token: SeTakeOwnershipPrivilege	4148	wmic.exe
Token: SeLoadDriverPrivilege	4148	wmic.exe
Token: SeSystemProfilePrivilege	4148	wmic.exe
Token: SeSystemtimePrivilege	4148	wmic.exe
Token: SeProfSingleProcessPrivilege	4148	wmic.exe
Token: SeIncBasePriorityPrivilege	4148	wmic.exe
Token: SeCreatePagefilePrivilege	4148	wmic.exe
Token: SeBackupPrivilege	4148	wmic.exe
Token: SeRestorePrivilege	4148	wmic.exe
Token: SeShutdownPrivilege	4148	wmic.exe
Token: SeDebugPrivilege	4148	wmic.exe
Token: SeSystemEnvironmentPrivilege	4148	wmic.exe
Token: SeRemoteShutdownPrivilege	4148	wmic.exe
Token: SeUndockPrivilege	4148	wmic.exe
Token: SeManageVolumePrivilege	4148	wmic.exe
Token: 33	4148	wmic.exe
Token: 34	4148	wmic.exe
Token: 35	4148	wmic.exe
Token: 36	4148	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2756	3504	99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe	82
PID 3504 wrote to memory of 2756	3504	99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe	82
PID 3504 wrote to memory of 2756	3504	99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe	82
PID 2756 wrote to memory of 4148	2756	bbhcabfcebdh.exe	84
PID 2756 wrote to memory of 4148	2756	bbhcabfcebdh.exe	84
PID 2756 wrote to memory of 4148	2756	bbhcabfcebdh.exe	84

C:\Users\Admin\AppData\Local\Temp\99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\99a0b14c0a219367262cc6c78e66382b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\bbhcabfcebdh.exe
  C:\Users\Admin\AppData\Local\Temp\bbhcabfcebdh.exe 9-6-0-9-4-6-7-9-4-8-0 JkpJOzkrMigwKSAmTVU5TEM9NCwYL0U/VE5LTERAQDUwFylEQE9OQjs5KCAmPUk7OSoZJkxKTztPQ0tbQz00LBgvSj9STUFMWExORD1fbnRnNikoamFqdiVuaFwpW2lnKVxha1suYGpgaBcrO0xAPUtAQDcZJkApPSQrICZALDYkLRgvOy09JC0aKDswNS0oGi87MTcmKBwnUElJREw/TlhHTkFWOD1ZNBwpSUlLPFU6Tl88UUY6NBwnUElJREw/TlhFPUVFNBovPFQ/WExORD0XKUVPQVk8REBESUU/PRcrQkhKUFdCSUlXSkFMNiwcJ1Q/O05CVUlOVlFKTDQaL01JNysXKzxTKDcgJk5PR0tFRUVWUUVDP0lGPEVFQT4/VUlINxkmRUtfSU9OS0VHPjRwanVcGi9JQU5OSUpBTj5ZVUpBTFg7PVFTNCwgJkRDPTxUNTEXKUlKWz5SRT1FSTpZRUU/TFJHUD1ENGBhY29fGSZAR1dFRk84QFlCRzkqMC8oMSgsKDIqKikyKRovS0VHPjQtLDIoLzMpLTErFys8T05ITEY9PlhLRUVFNCsvKDMpKyctLSooKjonLjQuKSZITQ==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81717635114.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81717635114.txt bios get version
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81717635114.txt bios get version
    3⤵
    PID:780
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81717635114.txt bios get version
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81717635114.txt bios get version
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 948
    3⤵
    - Program crash
    PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2756 -ip 2756
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81717635114.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81717635114.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81717635114.txt

Filesize
58B

MD5
f8e2f71e123c5a848f2a83d2a7aef11e

SHA1
5e7a9a2937fa4f06fdf3e33d7def7de431c159b4

SHA256
79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121

SHA512
8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbhcabfcebdh.exe

Filesize
192KB

MD5
fa4742e90fbea9aca66e435ef5d43ea9

SHA1
1b7e6a0df370917bca87a6577455160701c9e83a

SHA256
bfd9eeb2e8e8d9c741d76f3f03e7cdd1194aae102d9957721ce3cf6b9ea818e8

SHA512
5b450c16a78990713c7e943c93aab24c79fe42147de803cfef3333381239d2d4a9eccbac526c3d16ecf343e7249a8eae4af4dd85fb2fd2517d5d706b2700c2b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbhcabfcebdh.exe

Filesize
320KB

MD5
66d0a3fcb149d6855a970e362a42fd37

SHA1
5fd95596b8ac8f04dc29acb71852378ad2b5c279

SHA256
cb0696b037462958c427cf65ac0b21d14612c9c907083c68adbe1a75e7bf12b6

SHA512
bc7a83f32e4122f4b8cf7b757673ef0570e82940ccd95d5e46c979fd77beff8b46508758696afb91a3b63a4f7f15e04f9bee2a06c2f5b57325f527222a1c6b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4324.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd4324.tmp\you.dll

Filesize
121KB

MD5
591df37b3c00d9596dd1bc5cc75c9487

SHA1
3f26ba2e9557cacecfa4a40843028de7684bf9f9

SHA256
58bc550789f17246a712a481b3f8b423fad7f56f552f4928cdb18806931d8b1b

SHA512
88e429bde9ce0ef2fdd5a8e9a65ce3a71e1e8e689d5296968398a278d35358075cb727f1f699a24d00cf91f4217f752d422dc90154179650ffa9c52bda98b0f2

Download Submit

Analysis

Sharing