b8040c3b76cd7bedd0210fc154979e9269a4c24091d663d052874e8c3089cd7b

General

Target

239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe
Size

728KB
MD5

239241cb19cdc2a0ce398ea368e9c088
SHA1

3ad5544d1ea407c617a6acfb973de8bde05e0782
SHA256

b8040c3b76cd7bedd0210fc154979e9269a4c24091d663d052874e8c3089cd7b
SHA512

234b9e40ba967757682edadeb27a171c273accd46280208743d749d568ce7a1c330064275facb8d7a7f19d7150a72fc3034bfe318c9815e2ec6173261554864e
SSDEEP

12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMSmmcKDgGeItoEc9GspWZhASRXHYnrmO:z2QSmCrmgHCmKqMSkKlFtov9GsqRXHYh

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2008	netsh.exe
832	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1640	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	28
PID 2312 wrote to memory of 1640	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	28
PID 2312 wrote to memory of 1640	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	28
PID 2312 wrote to memory of 1640	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	28
PID 2312 wrote to memory of 2196	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2196	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2196	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2196	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2300	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2300	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2300	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2300	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2008	2300	cmd.exe	34
PID 2300 wrote to memory of 2008	2300	cmd.exe	34
PID 2300 wrote to memory of 2008	2300	cmd.exe	34
PID 2300 wrote to memory of 2008	2300	cmd.exe	34
PID 2312 wrote to memory of 3036	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	35
PID 2312 wrote to memory of 3036	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	35
PID 2312 wrote to memory of 3036	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	35
PID 2312 wrote to memory of 3036	2312	239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe	35
PID 3036 wrote to memory of 832	3036	cmd.exe	37
PID 3036 wrote to memory of 832	3036	cmd.exe	37
PID 3036 wrote to memory of 832	3036	cmd.exe	37
PID 3036 wrote to memory of 832	3036	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\239241cb19cdc2a0ce398ea368e9c088_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:832