18e28502ca178f56a0dba81c3092b9853cedf35ed1c96835fbca7ab459477b0a

General

Target

4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe
Size

731KB
MD5

4c1b1de45a7bd4468d8c106e1e00048f
SHA1

34500a5188a6b63341dcbd6cfb184d42e6bc3f27
SHA256

18e28502ca178f56a0dba81c3092b9853cedf35ed1c96835fbca7ab459477b0a
SHA512

18722b35b789b6fa2ddfb86beafbf392c46173b33e7ee183567fbf07ffc3d4a2bbc60ea149268223dcbebfd97959b914fa93b01bb202ff06ded9a15dbf9a1030
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmZFmjnDgGeIttwoPR5pWZhAIRXHYnrmw:JaigD/ArravUdsZwnlFttwYQRXHYrmw

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2276	netsh.exe
1164	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2684	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	30
PID 836 wrote to memory of 2684	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	30
PID 836 wrote to memory of 2684	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	30
PID 836 wrote to memory of 2684	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	30
PID 836 wrote to memory of 2308	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	32
PID 836 wrote to memory of 2308	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	32
PID 836 wrote to memory of 2308	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	32
PID 836 wrote to memory of 2308	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	32
PID 836 wrote to memory of 2536	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	34
PID 836 wrote to memory of 2536	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	34
PID 836 wrote to memory of 2536	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	34
PID 836 wrote to memory of 2536	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2276	2536	cmd.exe	36
PID 2536 wrote to memory of 2276	2536	cmd.exe	36
PID 2536 wrote to memory of 2276	2536	cmd.exe	36
PID 2536 wrote to memory of 2276	2536	cmd.exe	36
PID 836 wrote to memory of 2324	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	37
PID 836 wrote to memory of 2324	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	37
PID 836 wrote to memory of 2324	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	37
PID 836 wrote to memory of 2324	836	4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe	37
PID 2324 wrote to memory of 1164	2324	cmd.exe	39
PID 2324 wrote to memory of 1164	2324	cmd.exe	39
PID 2324 wrote to memory of 1164	2324	cmd.exe	39
PID 2324 wrote to memory of 1164	2324	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c1b1de45a7bd4468d8c106e1e00048f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1164