5bb47c3f962ba8f60cbdab0b06676d496b8679c4596fdd9dbe562715115ddd39

General

Target

0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
Size

1.5MB
MD5

0fe641fe7b902d87e6ba79949407f24f
SHA1

aa2fc8cbe46d640c85fa6ca1b068efa21e3e03b6
SHA256

5bb47c3f962ba8f60cbdab0b06676d496b8679c4596fdd9dbe562715115ddd39
SHA512

d3a8757801bd3c697c8d5f4095dd4f718c3da724a73a0d54f0609ff243d5cceda6049dca370406c3f4c80d4b6dc9f88d4926369954983c608fae85a33fa395d8
SSDEEP

24576:OKu4yDCW/A2M8RkbnCdXvy4sZ5r55brNQi08zg+mDObYTjvMA9:OKua2jsZ5ltrqt8WObYTzMA9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2612	AUDIODG.EXE
Token: SeDebugPrivilege	4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
4764	0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fe641fe7b902d87e6ba79949407f24f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-0-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-1-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4764-2-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-3-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-4-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4764-8-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-9-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-10-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-11-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-12-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-13-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-14-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-15-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-16-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-17-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/4764-18-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing