c6468e4b427896094122b8d11649f727e65c125356dbb52cb706f1872c3c0590

General

Target

051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe
Size

372KB
MD5

051db474da2d8aac1b97afab606ee2dc
SHA1

af91cf27695a2e101e745813e52b17ca5890db78
SHA256

c6468e4b427896094122b8d11649f727e65c125356dbb52cb706f1872c3c0590
SHA512

169f12f7be6bf2e50b749108f129d99c060b48b894164b916339aae16ae490df720841916cababc897643a13de68507bc76377b1ffdf1869f01c9d31ab885b4c
SSDEEP

6144:sTgKGSrPKWAzuuL3CU+d5TzlCAUVwPDs84B7ulxVffPVwOGwb09F64xjrA8r2kRY:s1TrPKpx3H+d5T5T484Badw+AtrA8Ckm

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1064	2294.exe
2284	2295.exe

Loads dropped DLL 4 IoCs

pid	Process
2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe
2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe
2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe
2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000400000-0x00000000004BD200-memory.dmp	upx
behavioral1/memory/2436-21-0x0000000000400000-0x00000000004BD200-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2284	2295.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	2295.exe
Token: SeDebugPrivilege	2284	2295.exe
Token: SeDebugPrivilege	1064	2294.exe
Token: SeDebugPrivilege	1064	2294.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1064	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 1064	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 1064	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 1064	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	28
PID 2436 wrote to memory of 2284	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2284	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2284	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2284	2436	051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\051db474da2d8aac1b97afab606ee2dc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\2294.exe
  "C:\Users\Admin\AppData\Local\Temp\2294.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\2295.exe
  "C:\Users\Admin\AppData\Local\Temp\2295.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2294.exe

Filesize
352KB

MD5
85598874535c32d0a643534a8010ac63

SHA1
74e30af4522d8c1308660cac8e92f84a4e31f2db

SHA256
92ece16d0a25124353743d3d09fc20ded1a316f73ca2dfcff14d7b8b7196ec69

SHA512
04e638d320ea5ba713667fd2971f6242f23c5a4094858fc532bb5b8850a26d97eb959848716a9e4f447f4f5fbfaf6d6ef349072c7b0a77f263912577ed821395

Download Submit
memory/1064-28-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1064-49-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1064-41-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1064-14-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1064-37-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1064-33-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1064-24-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1064-30-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/1064-26-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2284-23-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2284-29-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2284-27-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2284-34-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2284-25-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download
memory/2284-44-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2436-0-0x0000000000400000-0x00000000004BD200-memory.dmp

Filesize
756KB

Download
memory/2436-21-0x0000000000400000-0x00000000004BD200-memory.dmp

Filesize
756KB

Download
memory/2436-10-0x0000000002AB0000-0x0000000002BF4000-memory.dmp

Filesize
1.3MB

Download
memory/2436-12-0x0000000002AB0000-0x0000000002BF4000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing