f81b208bcf1907bdd65d175e0bf589afb8b4d578159810b470bbc1a905f13078

General

Target

52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
Size

170KB
MD5

52f6676242ad7776f212e652521cc6a3
SHA1

6c5de54bb5fb8a6c219afb394b70f2b798bf88d3
SHA256

f81b208bcf1907bdd65d175e0bf589afb8b4d578159810b470bbc1a905f13078
SHA512

10c65ef80e0e02797ae17766881c593112d392220d526bec872c57160852eba94597d58641b91c26cf07a1b8c9d1556c2dba75102098fb1de51582b5d809b142
SSDEEP

3072:27n6GeW2G+OKR+igvwg3HDOU/QcEiUwAKMvVx8VMLckceRd+pn3ZrN0yUb62D+MC:2T2PZgvwg3HnFEiPI82IUd+B3ZrNbe+9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2568 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

336 csrss.exe
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 94.242.250.64
Destination IP 94.242.250.64
Destination IP 94.242.250.64
Destination IP 94.242.250.64
Drops desktop.ini file(s) 2 IoCs

Processes:

csrss.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe
File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe

description pid process target process

PID 2708 set thread context of 2568 2708 52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe cmd.exe

pid	process
2568	cmd.exe

pid	process
336	csrss.exe

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

description	pid	process	target process
PID 2708 set thread context of 2568	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

52f6676242ad7776f212e652521cc6a3_JaffaCakes118.execsrss.exe

pid	process
2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
336	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe

pid process

2708 52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
Token: SeDebugPrivilege	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

csrss.exe

pid process

336 csrss.exe

pid	process
336	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

52f6676242ad7776f212e652521cc6a3_JaffaCakes118.execsrss.exe

description	pid	process	target process
PID 2708 wrote to memory of 1196	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	Explorer.EXE
PID 2708 wrote to memory of 336	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	csrss.exe
PID 2708 wrote to memory of 2568	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	cmd.exe
PID 2708 wrote to memory of 2568	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	cmd.exe
PID 2708 wrote to memory of 2568	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	cmd.exe
PID 2708 wrote to memory of 2568	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	cmd.exe
PID 2708 wrote to memory of 2568	2708	52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe	cmd.exe
PID 336 wrote to memory of 848	336	csrss.exe	svchost.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\52f6676242ad7776f212e652521cc6a3_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
fb9878fb6b69488ac6b769b76272104a

SHA1
48c4826aa276a5696f50940c3349775b2925a3d0

SHA256
fde8ad52fb931328955701fdf369a2d8ba9264cd7a4f88b5c8f7c35b3f7339ff

SHA512
6db179960aea15a886ed778571cf934f544195b687d6357aa26e535882c42d9e9113944e38b353d2a253b41e6458bb388c15aa982f5b3f5c7060ffbc33b17e38

Download Submit
memory/336-18-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/336-22-0x00000000022B0000-0x00000000022C1000-memory.dmp

Filesize
68KB

Download
memory/336-20-0x00000000022B0000-0x00000000022C1000-memory.dmp

Filesize
68KB

Download
memory/336-29-0x00000000022B0000-0x00000000022C1000-memory.dmp

Filesize
68KB

Download
memory/848-43-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/848-39-0x0000000000C50000-0x0000000000C5B000-memory.dmp

Filesize
44KB

Download
memory/848-36-0x0000000000C50000-0x0000000000C5B000-memory.dmp

Filesize
44KB

Download
memory/848-31-0x0000000000C50000-0x0000000000C5B000-memory.dmp

Filesize
44KB

Download
memory/848-42-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/848-44-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/848-40-0x0000000000C60000-0x0000000000C6B000-memory.dmp

Filesize
44KB

Download
memory/1196-8-0x00000000025D0000-0x00000000025D6000-memory.dmp

Filesize
24KB

Download
memory/1196-5-0x00000000025D0000-0x00000000025D6000-memory.dmp

Filesize
24KB

Download
memory/1196-12-0x00000000025D0000-0x00000000025D6000-memory.dmp

Filesize
24KB

Download
memory/1196-13-0x00000000025C0000-0x00000000025C2000-memory.dmp

Filesize
8KB

Download
memory/2708-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-25-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/2708-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2708-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-1-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads