0891a8aa1c0d3fd4a170d7fea80604d05db3f7e13c4325cc2ba6037e496d57e1

General

Target

30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe
Size

731KB
MD5

30d87ead1805768771e2528bb311b8f6
SHA1

e57535b78d206b3a689d976dd38905e593dfe7c5
SHA256

0891a8aa1c0d3fd4a170d7fea80604d05db3f7e13c4325cc2ba6037e496d57e1
SHA512

d5f3c20f4153686de47da22542dca9811315df640d1110a340b6c07299f0b34c2a3988f905439b403b4d7035c16e718fb47d179d67b04fb3e5473b484fd8de14
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpm3FmjnDgGeIttwoPR5pWZhAIRXHYnrm/:JaigD/ArravUds3wnlFttwYQRXHYrm/

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2780	netsh.exe
2740	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 888	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	31
PID 2512 wrote to memory of 888	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	31
PID 2512 wrote to memory of 888	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	31
PID 2512 wrote to memory of 888	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1864	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	33
PID 2512 wrote to memory of 1864	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	33
PID 2512 wrote to memory of 1864	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	33
PID 2512 wrote to memory of 1864	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	33
PID 2512 wrote to memory of 1168	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	35
PID 2512 wrote to memory of 1168	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	35
PID 2512 wrote to memory of 1168	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	35
PID 2512 wrote to memory of 1168	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	35
PID 1168 wrote to memory of 2740	1168	cmd.exe	37
PID 1168 wrote to memory of 2740	1168	cmd.exe	37
PID 1168 wrote to memory of 2740	1168	cmd.exe	37
PID 1168 wrote to memory of 2740	1168	cmd.exe	37
PID 2512 wrote to memory of 1060	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	38
PID 2512 wrote to memory of 1060	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	38
PID 2512 wrote to memory of 1060	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	38
PID 2512 wrote to memory of 1060	2512	30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe	38
PID 1060 wrote to memory of 2780	1060	cmd.exe	40
PID 1060 wrote to memory of 2780	1060	cmd.exe	40
PID 1060 wrote to memory of 2780	1060	cmd.exe	40
PID 1060 wrote to memory of 2780	1060	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30d87ead1805768771e2528bb311b8f6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2780