756e44864f5da691dcede1fc13d1cc413199257d03f9e432c79e115aef9092e7

General

Target

07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe
Size

731KB
MD5

07441a4524fdb4783345a10fcf62a95b
SHA1

0cad2e6d515bac257ca54e080e454732479afae5
SHA256

756e44864f5da691dcede1fc13d1cc413199257d03f9e432c79e115aef9092e7
SHA512

48e233404661a73775059fd0c6b628395c6ff205cf230c57de05180f46d8df82dcfffc4fa721544bc4f24c800d7ec15e98e05273a9704478fad688f96bc1d560
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmqFmjnDgGeIttwoPR5pWZhAIRXHYnrmt:JaigD/ArravUdsqwnlFttwYQRXHYrmt

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2140	netsh.exe
2740	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 820	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	28
PID 2108 wrote to memory of 820	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	28
PID 2108 wrote to memory of 820	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	28
PID 2108 wrote to memory of 820	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	28
PID 2108 wrote to memory of 1764	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1764	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1764	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1764	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	30
PID 2108 wrote to memory of 2248	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	32
PID 2108 wrote to memory of 2248	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	32
PID 2108 wrote to memory of 2248	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	32
PID 2108 wrote to memory of 2248	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2140	2248	cmd.exe	34
PID 2248 wrote to memory of 2140	2248	cmd.exe	34
PID 2248 wrote to memory of 2140	2248	cmd.exe	34
PID 2248 wrote to memory of 2140	2248	cmd.exe	34
PID 2108 wrote to memory of 2704	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	35
PID 2108 wrote to memory of 2704	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	35
PID 2108 wrote to memory of 2704	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	35
PID 2108 wrote to memory of 2704	2108	07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe	35
PID 2704 wrote to memory of 2740	2704	cmd.exe	37
PID 2704 wrote to memory of 2740	2704	cmd.exe	37
PID 2704 wrote to memory of 2740	2704	cmd.exe	37
PID 2704 wrote to memory of 2740	2704	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07441a4524fdb4783345a10fcf62a95b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2740