0c48ab92f21bc57cd8f1eb7aae4adb3541f9261da4bc065accdc4bd0fbecaf4c

General

Target

0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
Size

298KB
MD5

0aabbce1efd14327d50739e1e9be306b
SHA1

b778875fff7e8d4df1a7e35108cc686d83c007d2
SHA256

0c48ab92f21bc57cd8f1eb7aae4adb3541f9261da4bc065accdc4bd0fbecaf4c
SHA512

40c62ce6c8fc06f5e00e7987141840937b8c15f370f72ddea676014f832471f1b60f824589e0de5a7eeb16dfc352fffe1e5869200ac96dbcdccda964914ece2e
SSDEEP

6144:LEcEYCW+j1z1p5EmkC+h9A+x3X60zfriGZv2MaVl/s:xD4jV1gmkBhTJq0DrVJCVl/

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2580	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
Token: SeDebugPrivilege	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1260	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	21
PID 1720 wrote to memory of 332	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	2
PID 1720 wrote to memory of 2580	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2580	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2580	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2580	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	28
PID 1720 wrote to memory of 2580	1720	0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe	28
PID 332 wrote to memory of 2520	332	csrss.exe	30
PID 332 wrote to memory of 2520	332	csrss.exe	30
PID 332 wrote to memory of 2496	332	csrss.exe	31
PID 332 wrote to memory of 2496	332	csrss.exe	31
PID 332 wrote to memory of 836	332	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:836
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2520

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0aabbce1efd14327d50739e1e9be306b_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2580

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
260be49fbc84a3fd4ebe19cece864542

SHA1
b4cd7cca6209bcd57f9cbe1db033a9923581d5af

SHA256
35889e7896259d932ab3d18ddac03f74207b78c6e0215a92b526fc4bd7a35256

SHA512
64aca3b9fa773099f9877ae6da06624564e8549999e52c60dd425ef0da8053ac6285cbc8f11df410f94aa5ec0d202601f7d001c12fdada475b78208939514ed8

Download Submit
memory/332-29-0x0000000002140000-0x0000000002151000-memory.dmp

Filesize
68KB

Download
memory/332-18-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/332-21-0x0000000002140000-0x0000000002151000-memory.dmp

Filesize
68KB

Download
memory/332-20-0x0000000002140000-0x0000000002151000-memory.dmp

Filesize
68KB

Download
memory/836-40-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/836-35-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/836-43-0x00000000008D0000-0x00000000008DB000-memory.dmp

Filesize
44KB

Download
memory/836-41-0x00000000008D0000-0x00000000008DB000-memory.dmp

Filesize
44KB

Download
memory/836-31-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/836-39-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/1260-13-0x00000000029E0000-0x00000000029E2000-memory.dmp

Filesize
8KB

Download
memory/1260-12-0x00000000029F0000-0x00000000029F6000-memory.dmp

Filesize
24KB

Download
memory/1260-8-0x00000000029F0000-0x00000000029F6000-memory.dmp

Filesize
24KB

Download
memory/1260-4-0x00000000029F0000-0x00000000029F6000-memory.dmp

Filesize
24KB

Download
memory/1720-25-0x0000000000412000-0x0000000000416000-memory.dmp

Filesize
16KB

Download
memory/1720-28-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1720-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1720-24-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1720-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1720-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1720-1-0x0000000000412000-0x0000000000416000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing