a8430771ca865a3aef81e0b6547f56f7970dac4169aaa0fbc34c4ae7c74f1931

General

Target

059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
Size

208KB
MD5

059c1363bac26e65520c47da47d21b16
SHA1

34ceaad5ee9178fa58c10f2031638b4ab70d2650
SHA256

a8430771ca865a3aef81e0b6547f56f7970dac4169aaa0fbc34c4ae7c74f1931
SHA512

66e34219203417db428a44d43a547172ac28a0649cb736b5fb95a837fe6299a799dcea2bb12701631dab24b81cbd891f57cd6d204d76df19ce7149f17fac2eb0
SSDEEP

6144:w85qIz6+naOZcx6w+TDsRAV0PHK547HRSV:VqIz6XOklNRAV0Pqa9S

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2428	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2428	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
Token: SeDebugPrivilege	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1100	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	20
PID 2908 wrote to memory of 336	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	2
PID 2908 wrote to memory of 2428	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2428	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2428	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2428	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	28
PID 2908 wrote to memory of 2428	2908	059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe	28
PID 336 wrote to memory of 2560	336	csrss.exe	30
PID 336 wrote to memory of 2560	336	csrss.exe	30
PID 336 wrote to memory of 3068	336	csrss.exe	31
PID 336 wrote to memory of 3068	336	csrss.exe	31
PID 336 wrote to memory of 864	336	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:864
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2560

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1100
- C:\Users\Admin\AppData\Local\Temp\059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\059c1363bac26e65520c47da47d21b16_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2428

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
d6c7bb70c3ea2ae81adb40449dfa4533

SHA1
f58d0582fb11c30fbfc9954fa98e4d1d6fab5399

SHA256
b8424916333e2d4a9dc1206d4b1f64e877351234ac0c2ba33e3ad6185ceb214c

SHA512
a586fc3d1802a9030816d8ffe5b00aca40cbc5e7e423d10e1b909fdee93d8ffb9e99d35a910072fa6a842543ea6cb968d69e1c84c824e8fc39226af7c70588a4

Download Submit
memory/336-29-0x0000000000B70000-0x0000000000B81000-memory.dmp

Filesize
68KB

Download
memory/336-19-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/336-28-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/336-21-0x0000000000B70000-0x0000000000B81000-memory.dmp

Filesize
68KB

Download
memory/336-18-0x0000000000B70000-0x0000000000B81000-memory.dmp

Filesize
68KB

Download
memory/864-43-0x0000000000560000-0x000000000056B000-memory.dmp

Filesize
44KB

Download
memory/864-39-0x0000000000550000-0x000000000055B000-memory.dmp

Filesize
44KB

Download
memory/864-40-0x0000000000560000-0x000000000056B000-memory.dmp

Filesize
44KB

Download
memory/864-42-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/864-35-0x0000000000550000-0x000000000055B000-memory.dmp

Filesize
44KB

Download
memory/864-31-0x0000000000550000-0x000000000055B000-memory.dmp

Filesize
44KB

Download
memory/864-44-0x0000000000560000-0x000000000056B000-memory.dmp

Filesize
44KB

Download
memory/1100-12-0x0000000002580000-0x0000000002582000-memory.dmp

Filesize
8KB

Download
memory/1100-11-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/1100-7-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/1100-3-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/2908-27-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2908-24-0x0000000000426000-0x000000000042A000-memory.dmp

Filesize
16KB

Download
memory/2908-23-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2908-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2908-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2908-0-0x0000000000426000-0x000000000042A000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing