69396884385a6f57a06486b96dc2d5d8328bdd729e9064955bee51c4d76c94b5

General

Target

39451765b5d2e90cceab67706671adff_JaffaCakes118.exe
Size

635KB
MD5

39451765b5d2e90cceab67706671adff
SHA1

980f4d1538da6b368745c404290c1886cb021bba
SHA256

69396884385a6f57a06486b96dc2d5d8328bdd729e9064955bee51c4d76c94b5
SHA512

225e2025d0b1c20d46d0fd8a98a659f381346fd136df630fc9ae412a6bf4fbe00e03595e2570a44195e48ebae2ca02f82e211f61862f620431d56a5df98638c1
SSDEEP

12288:DascEJ+CwihxaDPoYXIG64LzakT50F3Z4mxxGCknbPHZzOS9kRf2+lIJeG:D1Y7pDPTzn0QmXCbxOS9Cf2v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1132	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe
File created	C:\Windows\svchost.exe	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe
Token: SeDebugPrivilege	1132	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1132	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4604	4620	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe	88
PID 4620 wrote to memory of 4604	4620	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe	88
PID 4620 wrote to memory of 4604	4620	39451765b5d2e90cceab67706671adff_JaffaCakes118.exe	88
PID 1132 wrote to memory of 4248	1132	svchost.exe	87
PID 1132 wrote to memory of 4248	1132	svchost.exe	87

C:\Users\Admin\AppData\Local\Temp\39451765b5d2e90cceab67706671adff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39451765b5d2e90cceab67706671adff_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4604

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
635KB

MD5
39451765b5d2e90cceab67706671adff

SHA1
980f4d1538da6b368745c404290c1886cb021bba

SHA256
69396884385a6f57a06486b96dc2d5d8328bdd729e9064955bee51c4d76c94b5

SHA512
225e2025d0b1c20d46d0fd8a98a659f381346fd136df630fc9ae412a6bf4fbe00e03595e2570a44195e48ebae2ca02f82e211f61862f620431d56a5df98638c1

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
8c5f522d18163e9c0e0d56db447d72b9

SHA1
b024f34bdd6a6874d79a18c6af772f7f7ba3e2c4

SHA256
e0c04fe541ef8a92c789f958e336b691e8fb341a8463ee5c3d607a38d211a493

SHA512
e505454678aff1f3482c3b272f7d872f6e807c0a46fa533f0c92a960269b3484170368cc5a32ff91dbbe7abdee5d9f121cbb073104e9c7d05c9e41712cb875f2

Download Submit
memory/1132-40-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4620-17-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4620-37-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4620-28-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/4620-3-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/4620-27-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4620-26-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/4620-14-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4620-23-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4620-22-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4620-21-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4620-20-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4620-19-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4620-18-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4620-0-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4620-1-0x0000000002330000-0x0000000002384000-memory.dmp

Filesize
336KB

Download
memory/4620-29-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/4620-24-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4620-13-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4620-12-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4620-11-0x00000000034D0000-0x00000000034D3000-memory.dmp

Filesize
12KB

Download
memory/4620-10-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4620-9-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/4620-8-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4620-7-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/4620-6-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/4620-5-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/4620-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4620-25-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4620-38-0x0000000002330000-0x0000000002384000-memory.dmp

Filesize
336KB

Download
memory/4620-15-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4620-2-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/4620-16-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing