ead6d4549195d0c058d9455c022eaa80e525a3223021e84e99765999958cf20a

General

Target

4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
Size

171KB
MD5

4bc21a3f14ed2be9af37d8f21a2c945b
SHA1

cb16353031b4ad25548cc461446a6ce79e87c900
SHA256

ead6d4549195d0c058d9455c022eaa80e525a3223021e84e99765999958cf20a
SHA512

36a7022a29aed1d66d5ea7d5746b51e4f81b4754514985e3082fc007ab411632fb893a20e680f9451e6c3b155d8f9f1f8c0dd5f8a786f58fcb3810537519e243
SSDEEP

3072:p7n6GqdOT7ob4Bma9cIrdf8JcT1EwEPdS1XAgmNzLl5uRVz/XAIYS5ceMMK:pTSdO/ob4cafh8+e5IxLmNzSVzvaS5ci

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2564	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 2564	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
332	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
Token: SeDebugPrivilege	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1200	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	21
PID 2260 wrote to memory of 332	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	2
PID 2260 wrote to memory of 2564	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2564	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2564	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2564	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	30
PID 2260 wrote to memory of 2564	2260	4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe	30
PID 332 wrote to memory of 2748	332	csrss.exe	32
PID 332 wrote to memory of 2748	332	csrss.exe	32
PID 332 wrote to memory of 852	332	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:852
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2748

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200
- C:\Users\Admin\AppData\Local\Temp\4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4bc21a3f14ed2be9af37d8f21a2c945b_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
e2a0c3fa5c712294a4139a8b619a7f23

SHA1
11e54d3e04d5662dc86fa09281877b6e56020645

SHA256
41a8b6a912cb4452d5d401bccba76c8246520925d8b7824e8019ffdd2483645a

SHA512
c51b8907ce48c0be9989ff1230bd4b0301a7fc1548826338884e74502bcaf530fe2c2dc7ca22a3545b3da765977503448cde8f0ac31679f198edc3f8b0ad2669

Download Submit
memory/332-30-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download
memory/332-29-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/332-20-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/332-21-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download
memory/332-19-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download
memory/852-43-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/852-36-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/852-40-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/852-41-0x0000000000C70000-0x0000000000C7B000-memory.dmp

Filesize
44KB

Download
memory/852-44-0x0000000000C70000-0x0000000000C7B000-memory.dmp

Filesize
44KB

Download
memory/852-32-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/852-45-0x0000000000C70000-0x0000000000C7B000-memory.dmp

Filesize
44KB

Download
memory/1200-4-0x0000000002CF0000-0x0000000002CF6000-memory.dmp

Filesize
24KB

Download
memory/1200-13-0x0000000002CE0000-0x0000000002CE2000-memory.dmp

Filesize
8KB

Download
memory/1200-8-0x0000000002CF0000-0x0000000002CF6000-memory.dmp

Filesize
24KB

Download
memory/1200-12-0x0000000002CF0000-0x0000000002CF6000-memory.dmp

Filesize
24KB

Download
memory/2260-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-25-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2260-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2260-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-1-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing