aea79b615cac2359076e6182805111533e0ac13649a234a7d777ea6af7cdf36c

General

Target

401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
Size

24KB
MD5

401ae4bfa3d30d2d4ed490132dedc7ec
SHA1

3f88fd78038f553fb25e6d4516f0f1fea9e3873a
SHA256

aea79b615cac2359076e6182805111533e0ac13649a234a7d777ea6af7cdf36c
SHA512

ab3e4d76a88b12e2ad324a23c17e91d8dc630c0d1c83b3ebef6880deb8c8ef3bae1f9127197f4093071e17376cc807699c300a748f3fec4112c3313c454f90b3
SSDEEP

384:KCfawfpYSBUm7Axpa8g/8+UvqBmknsLakXKYoCSXLEZb0fA09M0eL+8QiKR/:Ewf2SBUm8HnQmkt4ohgZb0H9iLFQiA

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1884	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2152	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 12 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\I:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\J:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\K:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\E:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\H:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\I:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\K:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\E:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\G:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\H:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File opened (read-only)	\??\G:	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
2152	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
2152	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
2152	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
2152	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1884	1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe	31
PID 1676 wrote to memory of 1884	1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe	31
PID 1676 wrote to memory of 1884	1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe	31
PID 1676 wrote to memory of 1884	1676	401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\401AE4~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1884

C:\Windows\SysWOW64\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
C:\Windows\SysWOW64\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\401ae4bfa3d30d2d4ed490132dedc7ec_JaffaCakes118.exe

Filesize
24KB

MD5
401ae4bfa3d30d2d4ed490132dedc7ec

SHA1
3f88fd78038f553fb25e6d4516f0f1fea9e3873a

SHA256
aea79b615cac2359076e6182805111533e0ac13649a234a7d777ea6af7cdf36c

SHA512
ab3e4d76a88b12e2ad324a23c17e91d8dc630c0d1c83b3ebef6880deb8c8ef3bae1f9127197f4093071e17376cc807699c300a748f3fec4112c3313c454f90b3

Download Submit
memory/1676-0-0x0000000000400000-0x000000000044A200-memory.dmp

Filesize
296KB

Download
memory/1676-1-0x0000000000400000-0x000000000044A200-memory.dmp

Filesize
296KB

Download
memory/1676-3-0x0000000000445000-0x000000000044A000-memory.dmp

Filesize
20KB

Download
memory/1676-2-0x0000000000400000-0x000000000044A200-memory.dmp

Filesize
296KB

Download
memory/1676-5-0x0000000000400000-0x000000000044A200-memory.dmp

Filesize
296KB

Download
memory/2152-9-0x0000000000400000-0x000000000044A200-memory.dmp

Filesize
296KB

Download
memory/2152-11-0x0000000000400000-0x000000000044A200-memory.dmp

Filesize
296KB

Download

Analysis

Sharing