8f7662ee33125eb7c8d53eb7b358aeb6451af51cd30cefd21fe9cd31b5397725

General

Target

3808287657286cad978f473a3cf3917d_JaffaCakes118.exe
Size

731KB
MD5

3808287657286cad978f473a3cf3917d
SHA1

687016c36a133189a598c2768cc98b2cd6e79b10
SHA256

8f7662ee33125eb7c8d53eb7b358aeb6451af51cd30cefd21fe9cd31b5397725
SHA512

aba448bdca1a63729ff4e5cafe1eee9a0f486d7928b3a6e1f19fcf9c7e1f0382019eee2968e8200fe42bf01c986c9d1bf458458e107afd39e907aeca2aea188a
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmsFmjnDgGeIttwoPR5pWZhAIRXHYnrmm:JaigD/ArravUdsswnlFttwYQRXHYrmm

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
888	netsh.exe
2072	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2300	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2300	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2300	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2300	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2432	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2432	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2432	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2432	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	30
PID 2160 wrote to memory of 2964	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	32
PID 2160 wrote to memory of 2964	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	32
PID 2160 wrote to memory of 2964	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	32
PID 2160 wrote to memory of 2964	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	32
PID 2964 wrote to memory of 2072	2964	cmd.exe	34
PID 2964 wrote to memory of 2072	2964	cmd.exe	34
PID 2964 wrote to memory of 2072	2964	cmd.exe	34
PID 2964 wrote to memory of 2072	2964	cmd.exe	34
PID 2160 wrote to memory of 2096	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	35
PID 2160 wrote to memory of 2096	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	35
PID 2160 wrote to memory of 2096	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	35
PID 2160 wrote to memory of 2096	2160	3808287657286cad978f473a3cf3917d_JaffaCakes118.exe	35
PID 2096 wrote to memory of 888	2096	cmd.exe	37
PID 2096 wrote to memory of 888	2096	cmd.exe	37
PID 2096 wrote to memory of 888	2096	cmd.exe	37
PID 2096 wrote to memory of 888	2096	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\3808287657286cad978f473a3cf3917d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3808287657286cad978f473a3cf3917d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:2300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:888