1b49860fac646d5aea77ff64493721ed85a818dddf411467fcea079c21f7b1a1

General

Target

4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe
Size

348KB
MD5

4332f1be4176944f222f7cea1bafb1b0
SHA1

2d44150d2e0722534ab05a44db0b88b0dedef33e
SHA256

1b49860fac646d5aea77ff64493721ed85a818dddf411467fcea079c21f7b1a1
SHA512

40b88a3cade170b2e5f2df37a87762b873d2228671ff436fcc9ade187a1034e13a7a7d3218310fc4aa68f45684d536a10fd5af4efddd62535c9c0c18e5e4debf
SSDEEP

6144:xNkTmF2idZecnl20lHRxp3gMncduD7yB9VCO6Sco4q8+dE6CqV8:xNSSF3Z4mxxHDqVTVOCV8

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2772	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2644	ntserver.exe

Loads dropped DLL 3 IoCs

pid	Process
3064	WerFault.exe
3064	WerFault.exe
3064	WerFault.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xcopy.exe	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntserver.dll	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntserver.exe	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntserver.exe	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	2644	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2180	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3064	2644	ntserver.exe	31
PID 2644 wrote to memory of 3064	2644	ntserver.exe	31
PID 2644 wrote to memory of 3064	2644	ntserver.exe	31
PID 2644 wrote to memory of 3064	2644	ntserver.exe	31
PID 2180 wrote to memory of 2772	2180	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2772	2180	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2772	2180	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2772	2180	4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4332f1be4176944f222f7cea1bafb1b0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4332F1~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2772

C:\Windows\SysWOW64\ntserver.exe
C:\Windows\SysWOW64\ntserver.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 64
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ntserver.exe

Filesize
40KB

MD5
edd177f6bb277fcca6b4a7c836ba8a70

SHA1
581528212f7d11c35516072e71f661ddcb956fca

SHA256
07fa44ff68fd87bc72450c94456a77405d26937d78dcc900bce113d2f25b450f

SHA512
ace181fff08a17814782e9f901229a508c5c7c786cf752d1e185d1612391c265cbfe83fc635e04d2ba49e7f306f37d52287f19988e0321615c414a576848aaa7

Download Submit
memory/2180-12-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2180-19-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/2180-18-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-17-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-16-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-15-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-14-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-13-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-9-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2180-2-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2180-11-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2180-0-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2180-8-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2180-7-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2180-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2180-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2180-4-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2180-3-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x0000000000330000-0x0000000000384000-memory.dmp

Filesize
336KB

Download
memory/2180-27-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2180-28-0x0000000000330000-0x0000000000384000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing