2b390d8f3d2320be2a5ddee8263fd0101e3ed5d8a3bd440d43285c8571dfd54d

General

Target

1ba8b7ae6aadf166732aeb9fbb8f5dcc_JaffaCakes118.exe
Size

715KB
MD5

1ba8b7ae6aadf166732aeb9fbb8f5dcc
SHA1

4a94b6ceec683657f1b46c1ac9d9ca26a1cd4404
SHA256

2b390d8f3d2320be2a5ddee8263fd0101e3ed5d8a3bd440d43285c8571dfd54d
SHA512

00df4f3d3a2036831facf6def0c9ef2a07c7edc081d85facd94e52dc027405d7a893e762c00b147c5ba1a11aa1e60c81760c018d8de98be99b68744760e05c24
SSDEEP

12288:gEPNwDwRqkEBcbeJRFjGBPzU429S7dpJ5KkPqQGHSz3Vt69Gn3gaxXeAJP2+8YR:ggwcQiciBwyj5z32I92s

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2860	taskkill.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
216	reg.exe
3468	reg.exe
4392	reg.exe
1704	reg.exe

C:\Users\Admin\AppData\Local\Temp\1ba8b7ae6aadf166732aeb9fbb8f5dcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ba8b7ae6aadf166732aeb9fbb8f5dcc_JaffaCakes118.exe"
1⤵
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\caiz.bat" "
  2⤵
  PID:972
- - C:\Windows\SysWOW64\taskkill.exe
    TASKKILL /F /IM C:\Users\Admin\AppData\Local\Temp\1ba8b7ae6aadf166732aeb9fbb8f5dcc_JaffaCakes118.exe
    3⤵
    - Kills process with taskkill
    PID:2860
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    PID:4208
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies registry key
      PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    PID:3952
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies registry key
      PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    PID:2076
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies registry key
      PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\machdas.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\machdas.exe:*:Enabled:Windows Messanger" /f
    3⤵
    PID:3140
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\machdas.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\machdas.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies registry key
      PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\caiz.bat

Filesize
241B

MD5
65db6caced4d687a92b5653b1579bc5d

SHA1
da39832e243999b5dd992534db550d4380684100

SHA256
9db6326e1bec139098a3aa43373cdd7216f6d365a644d54e7bd1c171c6bfebf1

SHA512
768fee17a24ef4397b196507973546274c88d3d3f36b898057396ca629ba83b5dd3d793bc31cfe46a3f0765775b7cfeed7b1d2970aa8915d9b6c363d4e362f7d

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
1KB

MD5
5b032d6dbc63d830be5ffa5dd679247a

SHA1
c3553f08c562034ff156b8c776be714b8af618f6

SHA256
30f4f452fc8ef6f5fbb5cdc2b5ca39eac48a634f1c328fa8dfe624616f295ada

SHA512
859bc96f0551dd23d0b84165e07e3fa78fa970c347c9925ce243931225074b4ae514f34484090d83250b49e377f63736b12c72db1403321d4da9d7e4d1542d90

Download Submit
memory/1876-22-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-23-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-35-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-10-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-15-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-34-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-30-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-27-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-25-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1876-26-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1928-2-0x0000000075310000-0x00000000758C1000-memory.dmp

Filesize
5.7MB

Download
memory/1928-0-0x0000000075312000-0x0000000075313000-memory.dmp

Filesize
4KB

Download
memory/1928-17-0x0000000075310000-0x00000000758C1000-memory.dmp

Filesize
5.7MB

Download
memory/1928-1-0x0000000075310000-0x00000000758C1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing