89069d21f61a81d8832f5d649e389e0cd3e0c84236d09ed9f3ffcccc8741f746

General

Target

2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe
Size

731KB
MD5

2bae5e869b9a0f7b4db0894a66eaec9c
SHA1

941ab6f9a681c7d96e41524558eaff6fb81959c3
SHA256

89069d21f61a81d8832f5d649e389e0cd3e0c84236d09ed9f3ffcccc8741f746
SHA512

d6d39483cf3cbaaea7e19bd3d3ee7c49b316043786fa6a8fde564ee6025f018b553c54aa789f651ba20f8fbf5b84309e6bd281eae1f5b434ef9a457b24d0f1dc
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmOFmjnDgGeIttwoPR5pWZhAIRXHYnrmp:JaigD/ArravUdsOwnlFttwYQRXHYrmp

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1888	netsh.exe
2176	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 3004	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	30
PID 2436 wrote to memory of 3004	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	30
PID 2436 wrote to memory of 3004	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	30
PID 2436 wrote to memory of 3004	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	30
PID 2436 wrote to memory of 2232	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2232	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2232	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2232	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2544	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	34
PID 2436 wrote to memory of 2544	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	34
PID 2436 wrote to memory of 2544	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	34
PID 2436 wrote to memory of 2544	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	34
PID 2544 wrote to memory of 2176	2544	cmd.exe	36
PID 2544 wrote to memory of 2176	2544	cmd.exe	36
PID 2544 wrote to memory of 2176	2544	cmd.exe	36
PID 2544 wrote to memory of 2176	2544	cmd.exe	36
PID 2436 wrote to memory of 2892	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	37
PID 2436 wrote to memory of 2892	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	37
PID 2436 wrote to memory of 2892	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	37
PID 2436 wrote to memory of 2892	2436	2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe	37
PID 2892 wrote to memory of 1888	2892	cmd.exe	39
PID 2892 wrote to memory of 1888	2892	cmd.exe	39
PID 2892 wrote to memory of 1888	2892	cmd.exe	39
PID 2892 wrote to memory of 1888	2892	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bae5e869b9a0f7b4db0894a66eaec9c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1888