9d52355ef9b1777563fb08a45c581c655ce44bc199f6b9e82b7a74b6d5cdd73a

General

Target

48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe
Size

11KB
MD5

48ed6cc822708e4f15f78d7c1a6214ec
SHA1

449a87c91749c11350b9f238e404f6065a6bb2d1
SHA256

9d52355ef9b1777563fb08a45c581c655ce44bc199f6b9e82b7a74b6d5cdd73a
SHA512

4af068d0e133f1e68f785802fca39b770110aa8239538e122132e0063a8cd867e1994901785292fb7c9c4c1288f769f032c899243653863bcfdc1d4131e0a79d
SSDEEP

192:NE4JgPu/PlfaC8NahI7yFJQT0V6RfCyG/B9ShZVuIaMAUaUGo7/r1Bclg:NE4WPOfarNa3JK0V5whGIahUaUGof8g

Score

8^/10

persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2652	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	aotopptk.exe

Loads dropped DLL 2 IoCs

pid	Process
2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe
2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x0008000000018f6e-3.dat	upx
behavioral1/memory/2148-5-0x0000000000230000-0x000000000023E000-memory.dmp	upx
behavioral1/memory/2212-12-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2148-13-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2212-14-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\aotoppt.dll	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\aotopptk.exe	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\aotopptk.exe	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2212	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	29
PID 2148 wrote to memory of 2212	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	29
PID 2148 wrote to memory of 2212	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	29
PID 2148 wrote to memory of 2212	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	29
PID 2148 wrote to memory of 2652	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2652	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2652	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2652	2148	48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\aotopptk.exe
  C:\Windows\system32\aotopptk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\48ed6cc822708e4f15f78d7c1a6214ec_JaffaCakes118.exe.bat

Filesize
210B

MD5
f59c2ffb77b007a003deec692d0d0605

SHA1
6b141a1a7adf43b691f1978faf7e592b3a082602

SHA256
08389acb836094dd9540be231516900dbe0a8878a3d9f26c37f7295d111abd0d

SHA512
4a5e10f49b6552416425260b458a179b01dc03ad20777ed6d8079d765b9668bfc87583b608a7d3d540dcf3b4279054b9fe7e77e61fe762623219e220166cbf76

Download Submit
\Windows\SysWOW64\aotopptk.exe

Filesize
11KB

MD5
48ed6cc822708e4f15f78d7c1a6214ec

SHA1
449a87c91749c11350b9f238e404f6065a6bb2d1

SHA256
9d52355ef9b1777563fb08a45c581c655ce44bc199f6b9e82b7a74b6d5cdd73a

SHA512
4af068d0e133f1e68f785802fca39b770110aa8239538e122132e0063a8cd867e1994901785292fb7c9c4c1288f769f032c899243653863bcfdc1d4131e0a79d

Download Submit
memory/2148-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2148-5-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/2148-10-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/2148-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2148-15-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/2148-18-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/2212-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2212-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing