0e2cc0d61a8dce14e5fc9370f28df7d72f28fbd1d9d95e05c2b14e0500155a80

General

Target

26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
Size

176KB
MD5

26e6607fd06113a8b339b087f524500c
SHA1

27b7896750532a8a9c6685c71b2f41867504a53d
SHA256

0e2cc0d61a8dce14e5fc9370f28df7d72f28fbd1d9d95e05c2b14e0500155a80
SHA512

d24a47a6cea9161382eee02f8ad61291a5f5b7d9e562054262a093feaefa18f671ceba3bac7998725b5c15f321fd6bf8442507ec38fb734d666367d56ebe5fb2
SSDEEP

3072:I/gPUZAjpDzFZeapdSbn4p+cKg91GAFWj2iQKGYV0JwVzNc7:njpNZXL+cF9YAF425KhVh

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2576	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 2576	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
Token: SeDebugPrivilege	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1164	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	21
PID 2704 wrote to memory of 336	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	2
PID 2704 wrote to memory of 2576	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2576	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2576	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2576	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	31
PID 2704 wrote to memory of 2576	2704	26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe	31
PID 336 wrote to memory of 844	336	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:844

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1164
- C:\Users\Admin\AppData\Local\Temp\26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\26e6607fd06113a8b339b087f524500c_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
7111bddfd8fbee1cf600c93646ba5a61

SHA1
ea048602730b5ba9865f746e92a03a63230e63dc

SHA256
49dcd7aa1b325b83be744f84e884bf3f6e59a6b74cce5ce0c0fb1a0989b17295

SHA512
e452568c057a7fb8a02268b6f39f6a7b03d877710f2f1107e3ce08c1496dd2e9a7fcc8be0769e44aaf17c48dd43c1379df7d74c460f9361378e586bce5f576de

Download Submit
memory/336-30-0x0000000000C60000-0x0000000000C71000-memory.dmp

Filesize
68KB

Download
memory/336-31-0x0000000000C60000-0x0000000000C71000-memory.dmp

Filesize
68KB

Download
memory/336-29-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/336-21-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/336-22-0x0000000000C60000-0x0000000000C71000-memory.dmp

Filesize
68KB

Download
memory/336-20-0x0000000000C60000-0x0000000000C71000-memory.dmp

Filesize
68KB

Download
memory/844-45-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/844-37-0x0000000000C50000-0x0000000000C5B000-memory.dmp

Filesize
44KB

Download
memory/844-42-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/844-41-0x0000000000C50000-0x0000000000C5B000-memory.dmp

Filesize
44KB

Download
memory/844-33-0x0000000000C50000-0x0000000000C5B000-memory.dmp

Filesize
44KB

Download
memory/844-44-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/844-46-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/1164-14-0x0000000002D50000-0x0000000002D56000-memory.dmp

Filesize
24KB

Download
memory/1164-10-0x0000000002D50000-0x0000000002D56000-memory.dmp

Filesize
24KB

Download
memory/1164-6-0x0000000002D50000-0x0000000002D56000-memory.dmp

Filesize
24KB

Download
memory/1164-5-0x0000000002D40000-0x0000000002D42000-memory.dmp

Filesize
8KB

Download
memory/2704-28-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2704-27-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2704-26-0x0000000000220000-0x0000000000246000-memory.dmp

Filesize
152KB

Download
memory/2704-25-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2704-1-0x0000000000220000-0x0000000000246000-memory.dmp

Filesize
152KB

Download
memory/2704-2-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2704-3-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2704-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2704-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing