4d12d1a83b5392d1c188d47409dfdb978fe2179bdcf18f77ee65ead254543be8

General

Target

2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe
Size

728KB
MD5

2f5519a0b51c9a3f491e56eedcbd615d
SHA1

15fd601d0ca00e8623742788e6e0e933e0fdf17b
SHA256

4d12d1a83b5392d1c188d47409dfdb978fe2179bdcf18f77ee65ead254543be8
SHA512

35e1743509119ff9b556978bdcda5a72142bf5b5e7d732282db41b43edd5ffc9836e4237c772e31244768489306f7c79e44c96fcfb248f008a5b86a9ee840be6
SSDEEP

12288:z2/I3CMZC4u8YBbY5zgHWHmt8qMUmmcKDgGeItoEc9GspWZhASRXHYnrm/:z2QSmCrmgHCmKqMUkKlFtov9GsqRXHYg

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1924	netsh.exe
2844	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1324	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	31
PID 1984 wrote to memory of 1324	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	31
PID 1984 wrote to memory of 1324	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	31
PID 1984 wrote to memory of 1324	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	31
PID 1984 wrote to memory of 2464	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2464	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2464	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2464	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2892	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	35
PID 1984 wrote to memory of 2892	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	35
PID 1984 wrote to memory of 2892	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	35
PID 1984 wrote to memory of 2892	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	35
PID 2892 wrote to memory of 1924	2892	cmd.exe	37
PID 2892 wrote to memory of 1924	2892	cmd.exe	37
PID 2892 wrote to memory of 1924	2892	cmd.exe	37
PID 2892 wrote to memory of 1924	2892	cmd.exe	37
PID 1984 wrote to memory of 2712	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	38
PID 1984 wrote to memory of 2712	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	38
PID 1984 wrote to memory of 2712	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	38
PID 1984 wrote to memory of 2712	1984	2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe	38
PID 2712 wrote to memory of 2844	2712	cmd.exe	40
PID 2712 wrote to memory of 2844	2712	cmd.exe	40
PID 2712 wrote to memory of 2844	2712	cmd.exe	40
PID 2712 wrote to memory of 2844	2712	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f5519a0b51c9a3f491e56eedcbd615d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2844