955d5d2bf1cd67196b174dde14c9871b37c72b08777915836cb246b86e3e68ba

General

Target
4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
Size 200KB
Sample240716-e6zbhaxhkb
SHA256 955d5d2bf1cd67196b174dde14c9871b37c72b08777915836cb246b86e3e68ba
MD5 4cd0aa65d375f9edb94986ff5785834d
SHA1 8c3a4811588a9281011542decd827daf028eb4f2
SHA512 07423da446e8dd68873028336a1420567a633646142ce63e7498f60ef94f36b1303c2e8a71ac126300a51a086e58e3126a54b8c2a585a07dd6f05449ac616ace
SSDEEP 6144:jD/SXeNQCJXtEpIE5nVWJVErxIgldFaobgVl:iuNtJXjE5nV2VSldFaobgVl
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
788	netsh.exe
3520	netsh.exe
4420	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
636	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3180	636	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	86
PID 636 wrote to memory of 3180	636	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	86
PID 636 wrote to memory of 3180	636	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	86
PID 3180 wrote to memory of 3164	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	87
PID 3180 wrote to memory of 3164	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	87
PID 3180 wrote to memory of 3164	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	87
PID 3164 wrote to memory of 788	3164	cmd.exe	89
PID 3164 wrote to memory of 788	3164	cmd.exe	89
PID 3164 wrote to memory of 788	3164	cmd.exe	89
PID 3180 wrote to memory of 5072	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	90
PID 3180 wrote to memory of 5072	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	90
PID 3180 wrote to memory of 5072	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	90
PID 5072 wrote to memory of 3520	5072	cmd.exe	92
PID 5072 wrote to memory of 3520	5072	cmd.exe	92
PID 5072 wrote to memory of 3520	5072	cmd.exe	92
PID 3180 wrote to memory of 660	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	97
PID 3180 wrote to memory of 660	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	97
PID 3180 wrote to memory of 660	3180	4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe	97
PID 660 wrote to memory of 4420	660	cmd.exe	99
PID 660 wrote to memory of 4420	660	cmd.exe	99
PID 660 wrote to memory of 4420	660	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\jiii\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\jiii\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jiii\vtvdya.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram program="C:\Users\Admin\AppData\Local\Temp\jiii\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe" profile=All
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jiii\jmtrpb.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram PROGRAM="C:\Users\Admin\AppData\Local\Temp\jiii\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe" NAME="lvideo" MODE=ENABLE PROFILE=ALL
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jiii\yjyhqrrcv.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram program="C:\Users\Admin\AppData\Local\Temp\jiii\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe" profile=All
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe

Path C:\Users\Admin\AppData\Local\Temp\jiii\4cd0aa65d375f9edb94986ff5785834d_JaffaCakes118.exe
Size 200KB
SHA256 955d5d2bf1cd67196b174dde14c9871b37c72b08777915836cb246b86e3e68ba
MD5 4cd0aa65d375f9edb94986ff5785834d
SHA1 8c3a4811588a9281011542decd827daf028eb4f2
SHA512 07423da446e8dd68873028336a1420567a633646142ce63e7498f60ef94f36b1303c2e8a71ac126300a51a086e58e3126a54b8c2a585a07dd6f05449ac616ace
SSDEEP 6144:jD/SXeNQCJXtEpIE5nVWJVErxIgldFaobgVl:iuNtJXjE5nV2VSldFaobgVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmtrpb.bat

Path C:\Users\Admin\AppData\Local\Temp\jiii\jmtrpb.bat
Size 238B
SHA256 43bc64c4225d313de3c6ef3974d170127658e7fc03957175daa9c2cbcc8904ad
MD5 9c3819b7137ecfc621e390d78ba46f0b
SHA1 f36a2a11942bbeaf00f6e0341436020233f35218
SHA512 b2c9ec1dc2f9486acacc8479eea069d5138fd3adf5f5dff3feee7e476511bd0b6bb6443a493935e29d6a464ea1327492d9dd5b07c88e33da35bf0aeed85bcb05
MD5 SHA1 SHA512

Submit Download

vtvdya.bat

Path C:\Users\Admin\AppData\Local\Temp\jiii\vtvdya.bat
Size 211B
SHA256 b55fc58d07c95ed125f22b274893dc7e75125758415b8d4e05c25c14e8eefbea
MD5 a1902b18cc77d2648ad937637830a090
SHA1 f166051438112f38146f32c37335182ec538aca7
SHA512 91f8fc4219534b13caa9b37737ae38ccbe9e69d151f7d64cb40304f2c263b7a8941a14cbfe792c3c6c03d97a8ef5d88278c1b325c343958d9c79cea4f10e37bf
MD5 SHA1 SHA512

Submit Download

yjyhqrrcv.bat

Path C:\Users\Admin\AppData\Local\Temp\jiii\yjyhqrrcv.bat
Size 214B
SHA256 c5cd20eadaed2e349c1670ef87e99f4d522817dce2b3be50de0a6ccfbc627b0e
MD5 35d84db82818847b4891b105df07d4eb
SHA1 84aab3a6044bc78ee4d72f67b1f672b7d525c52a
SHA512 5fa75d9eceb42fd8e5dff9fb26ab4d7d5225018a84014761420651f7d69752e6509e8c555d3a5c374b1bf3ced16862dcbc1bb1e24a9b02aae9c26722be2c9f92
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads