96639d112ce10d8bda2300154364d1ae87874bec27f278ab309aa50781ba2b61

General

Target

03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe
Size

68KB
MD5

03f87bd8ef2414bf4f7da61761bf1a32
SHA1

c4e109ef2b01f153eaca93f93084161dd0824372
SHA256

96639d112ce10d8bda2300154364d1ae87874bec27f278ab309aa50781ba2b61
SHA512

2b510cd11ac49b2c77c7084bcf586a055ed5d58d7126aab9d8d0cc393b153b988c3857a86158665ce5baef2546f4a1ad5b2f125c6e6c77c2042aeebef6d33594
SSDEEP

1536:g5NqCJWGdOJZ2PMhX6M4MMyRNTpfK6XVTkb:g5NqCQZAM1DbdRXVAb

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	2980	rundll32.exe
6	2648	rundll32.exe
7	2648	rundll32.exe
8	2980	rundll32.exe
9	2648	rundll32.exe
10	2648	rundll32.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2980	rundll32.exe
2648	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\2283880F-EF87-4aac-8EBD-C9BCC8494AF5_46 = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\2283880F-EF87-4aac-8EBD-C9BCC8494AF5_46.avi\", start"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe
Token: SeDebugPrivilege	2980	rundll32.exe
Token: SeDebugPrivilege	2648	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2372 wrote to memory of 2980	2372	03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe	28
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29
PID 2980 wrote to memory of 2648	2980	rundll32.exe	29

C:\Users\Admin\AppData\Local\Temp\03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03f87bd8ef2414bf4f7da61761bf1a32_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\\1c5cc7d0-28e5-4cb1-a208-0dc4bd218e60\wrk144C.tmp_46", start first worker
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\\1c5cc7d0-28e5-4cb1-a208-0dc4bd218e60\wrk2C7D.tmp_46", start task worker
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1c5cc7d0-28e5-4cb1-a208-0dc4bd218e60\wrk144C.tmp_46

Filesize
68KB

MD5
ebea490322e01235e762ee5ff1c707da

SHA1
3e7d9db49e1c7bf94b851bc796339296362982a5

SHA256
a9fb01fa670a3bc6ee074f25ccb45bdc4ca43cc7b857a0455949fe31a003e03d

SHA512
8f8ff81a7e59c489909f93a0a15e55e1da0572e10c59db99d7b9c1d07b30d5cd5e16a07f8746ff6c03c25c6735983f720374a893a5f5a0ada7cbdaf19343edfb

Download Submit
memory/2372-0-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2372-5-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2648-23-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2648-29-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2980-8-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2980-15-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2980-28-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads