3e30f0af7c7899a7c7aea62ba6ca70e2324896c8a935df4e4515941812f71104

General

Target

2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe
Size

594KB
MD5

2e75b43271573a2d36d9160d9595ea12
SHA1

1975a342a3b35a7047b0e9ff9f193f5b7d1b1f9a
SHA256

3e30f0af7c7899a7c7aea62ba6ca70e2324896c8a935df4e4515941812f71104
SHA512

bea9c55a964c8b2fa7884cc8ec6dc60da868601e8a7b061a17066a8bff0463f74713cac7fabb3a2e75862af8afb1dd22e7a99884821cfc68267d9bd5e03eb16b
SSDEEP

12288:D5XiRHau4V/4HOV9eoNqcF3Z4mxxaDqVTVOCqup:1Xiau4V/UdoNDQmXhVTzH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2820	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	G_Server1.23.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\G_Server1.23.exe	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe
File opened for modification	C:\Windows\G_Server1.23.exe	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe
File created	C:\Windows\Delete.bat	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	G_Server1.23.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe
Token: SeDebugPrivilege	2680	G_Server1.23.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	G_Server1.23.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2592	2680	G_Server1.23.exe	31
PID 2680 wrote to memory of 2592	2680	G_Server1.23.exe	31
PID 2680 wrote to memory of 2592	2680	G_Server1.23.exe	31
PID 2680 wrote to memory of 2592	2680	G_Server1.23.exe	31
PID 3052 wrote to memory of 2820	3052	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2820	3052	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2820	3052	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2820	3052	2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e75b43271573a2d36d9160d9595ea12_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:2820

C:\Windows\G_Server1.23.exe
C:\Windows\G_Server1.23.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
214B

MD5
7ea2e20ef70ae4eb4ca5e7cf9e2e62c1

SHA1
b84fc68f869e8db5c4226bce93c271dcc7c4e2c4

SHA256
c873f497ba476fb633221c01f60143823d4286f47682417f2424a02424fce358

SHA512
ef147a0ec59b8d114b1c4ba5ed89ca5d6cfdab31ef425c857715f2ccd7aa4332c4ad1670a71089f87ebad24d09186f1eceb00b7cda05118b6f320cfc1c782fc9

Download Submit
C:\Windows\G_Server1.23.exe

Filesize
594KB

MD5
2e75b43271573a2d36d9160d9595ea12

SHA1
1975a342a3b35a7047b0e9ff9f193f5b7d1b1f9a

SHA256
3e30f0af7c7899a7c7aea62ba6ca70e2324896c8a935df4e4515941812f71104

SHA512
bea9c55a964c8b2fa7884cc8ec6dc60da868601e8a7b061a17066a8bff0463f74713cac7fabb3a2e75862af8afb1dd22e7a99884821cfc68267d9bd5e03eb16b

Download Submit
memory/2680-36-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2680-33-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2680-21-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/3052-17-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/3052-5-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3052-16-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3052-15-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3052-13-0x00000000034B0000-0x00000000034B1000-memory.dmp

Filesize
4KB

Download
memory/3052-12-0x00000000033B0000-0x00000000033B3000-memory.dmp

Filesize
12KB

Download
memory/3052-11-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/3052-14-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/3052-6-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/3052-0-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/3052-4-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3052-3-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/3052-2-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3052-10-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/3052-7-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3052-8-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3052-30-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/3052-31-0x0000000000360000-0x00000000003B4000-memory.dmp

Filesize
336KB

Download
memory/3052-9-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/3052-1-0x0000000000360000-0x00000000003B4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing