f99a84ebbca288c41845baea8348c7e65266569431a1d9c3054f6d9cc6944fb7

General

Target

21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe
Size

731KB
MD5

21486866ee8cb9d92b9e88cc74ecf63b
SHA1

2f59a0f0b341e4a16ff2ef0fce3528744bd60745
SHA256

f99a84ebbca288c41845baea8348c7e65266569431a1d9c3054f6d9cc6944fb7
SHA512

58aac11363622bcc18ab0d57037781f2da4c57a49fb872f27bf4fc263a92f5de8bec25a752be83bd9de7e94357b2fef635480b0134ab1ba4c4aaf659ca812610
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmKFmjnDgGeIttwoPR5pWZhAIRXHYnrmx:JaigD/ArravUdsKwnlFttwYQRXHYrmx

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2752	netsh.exe
2552	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3004	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	28
PID 2360 wrote to memory of 3004	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	28
PID 2360 wrote to memory of 3004	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	28
PID 2360 wrote to memory of 3004	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	28
PID 2360 wrote to memory of 2184	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2184	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2184	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2184	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	30
PID 2360 wrote to memory of 2648	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2648	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2648	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2648	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	32
PID 2648 wrote to memory of 2752	2648	cmd.exe	34
PID 2648 wrote to memory of 2752	2648	cmd.exe	34
PID 2648 wrote to memory of 2752	2648	cmd.exe	34
PID 2648 wrote to memory of 2752	2648	cmd.exe	34
PID 2360 wrote to memory of 2748	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2748	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2748	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2748	2360	21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe	35
PID 2748 wrote to memory of 2552	2748	cmd.exe	37
PID 2748 wrote to memory of 2552	2748	cmd.exe	37
PID 2748 wrote to memory of 2552	2748	cmd.exe	37
PID 2748 wrote to memory of 2552	2748	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21486866ee8cb9d92b9e88cc74ecf63b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2552