a530c32fb9a7056f33f434379f5d9e6287e38d853e4755fe6350dbe88353ea67

General

Target

0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe
Size

731KB
MD5

0758ac59d414aacdf695219db42f30aa
SHA1

878b20b64118cb5f3dd8ed1ca96000140a53da5d
SHA256

a530c32fb9a7056f33f434379f5d9e6287e38d853e4755fe6350dbe88353ea67
SHA512

c172ed58781071736be4e57f87923c1227bd5bea895db5aa190555815a6a00c2993631fc8e5def8994dd93ad3c440fb5f72dbff8aa911e4d0c3fcff24277d15f
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmOFmjnDgGeIttwoPR5pWZhAIRXHYnrmg:JaigD/ArravUdsOwnlFttwYQRXHYrmg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2824	netsh.exe
3024	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2316	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2316	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2316	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2316	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	28
PID 1964 wrote to memory of 2568	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2568	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2568	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2568	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2672	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	32
PID 1964 wrote to memory of 2672	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	32
PID 1964 wrote to memory of 2672	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	32
PID 1964 wrote to memory of 2672	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	32
PID 2672 wrote to memory of 2824	2672	cmd.exe	34
PID 2672 wrote to memory of 2824	2672	cmd.exe	34
PID 2672 wrote to memory of 2824	2672	cmd.exe	34
PID 2672 wrote to memory of 2824	2672	cmd.exe	34
PID 1964 wrote to memory of 2588	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	35
PID 1964 wrote to memory of 2588	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	35
PID 1964 wrote to memory of 2588	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	35
PID 1964 wrote to memory of 2588	1964	0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe	35
PID 2588 wrote to memory of 3024	2588	cmd.exe	37
PID 2588 wrote to memory of 3024	2588	cmd.exe	37
PID 2588 wrote to memory of 3024	2588	cmd.exe	37
PID 2588 wrote to memory of 3024	2588	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0758ac59d414aacdf695219db42f30aa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3024