d09c5319728bbf63a9d015b51c66cede117c3f7b6c6288afa1ec96e8bcb7c989

General

Target

2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
Size

171KB
MD5

2c895daa47e7e14a23935dc9977b9491
SHA1

748d0dc60566249d69987301ee1ecd799cc42009
SHA256

d09c5319728bbf63a9d015b51c66cede117c3f7b6c6288afa1ec96e8bcb7c989
SHA512

0dab10fd5616b7096514205c732dc9e3c57f1f1789cc1cde1427f363d844657bcfd3e4115ea39eb95fcd228b9208846eb9391df52b86a14d7f45114d35e3bd31
SSDEEP

3072:AHC7Azgo4qRXDPSsw5c1blU4VwUvFn6CWgpU9DbYKF8g+1t/HuHa/lmM:eMo42XOb5YxN+UNn6VgpEM88l1tvcmlm

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2328	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2328	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
Token: SeDebugPrivilege	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1196	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	21
PID 2064 wrote to memory of 332	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	2
PID 332 wrote to memory of 2824	332	csrss.exe	30
PID 332 wrote to memory of 2824	332	csrss.exe	30
PID 2064 wrote to memory of 2328	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2328	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2328	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2328	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	31
PID 2064 wrote to memory of 2328	2064	2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe	31
PID 332 wrote to memory of 864	332	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:864
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2c895daa47e7e14a23935dc9977b9491_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
bf95f924cf748addde39679b73fe4d37

SHA1
34109eae0fb2c53e16e0f0b4218f7fa76f19b3ee

SHA256
1e26d09abff8ff5be824e5deb2f926d82b4ab4af5ff70127997b10e7f84ae2c4

SHA512
9d79e585ff35943d9100bd76555a473c45a506516001738c6db73ca73e201359b456702fce515d9734f07cdf029de0cf80be8ec16c2deb4592efeb4008d079aa

Download Submit
memory/332-19-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/332-29-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/332-22-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/332-21-0x0000000002520000-0x0000000002531000-memory.dmp

Filesize
68KB

Download
memory/864-40-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/864-35-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/864-44-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/864-42-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/864-43-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/864-31-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/864-39-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/1196-14-0x0000000002D80000-0x0000000002D82000-memory.dmp

Filesize
8KB

Download
memory/1196-9-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/1196-13-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/1196-5-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/2064-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2064-3-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2064-2-0x0000000000427000-0x000000000042C000-memory.dmp

Filesize
20KB

Download
memory/2064-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2064-26-0x0000000000427000-0x000000000042C000-memory.dmp

Filesize
20KB

Download
memory/2064-25-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2064-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2064-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing