2b63b8b0c94e9e98b06fd4ea65a57afc015aeb952e50af913f6b2677ea246dfd

General

Target

5ae48ab82599784bec09e3ebb23f979b_JaffaCakes118.exe
Size

296KB
MD5

5ae48ab82599784bec09e3ebb23f979b
SHA1

a0a0ab4f6a51760194c4d8d6c2a959b7dcca3d8f
SHA256

2b63b8b0c94e9e98b06fd4ea65a57afc015aeb952e50af913f6b2677ea246dfd
SHA512

b2d12c8ca7c2a89158844344a065a5d67f04b5ceb7ba72792547d69f0da589866ef387a199a8a4a064bf201d4276e2e3b9dc19c2690e1c3060358ec5e519cd09
SSDEEP

6144:3I1xxVkdx0AuqeJ+IhhKHZNmSAPbB74EISjy:3IFmGVbAbmjB74Er

Score

10^/10

evasion persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2060	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1732	Neobot.exe
2568	Neobot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Neobot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Neobot.exe"	Neobot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2752	reg.exe
2368	reg.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe
2568	Neobot.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	Neobot.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	Neobot.exe
2568	Neobot.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1732	2876	5ae48ab82599784bec09e3ebb23f979b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1732	2876	5ae48ab82599784bec09e3ebb23f979b_JaffaCakes118.exe	29
PID 2876 wrote to memory of 1732	2876	5ae48ab82599784bec09e3ebb23f979b_JaffaCakes118.exe	29
PID 1732 wrote to memory of 3052	1732	Neobot.exe	31
PID 1732 wrote to memory of 3052	1732	Neobot.exe	31
PID 1732 wrote to memory of 3052	1732	Neobot.exe	31
PID 1732 wrote to memory of 2568	1732	Neobot.exe	33
PID 1732 wrote to memory of 2568	1732	Neobot.exe	33
PID 1732 wrote to memory of 2568	1732	Neobot.exe	33
PID 3052 wrote to memory of 2752	3052	cmd.exe	34
PID 3052 wrote to memory of 2752	3052	cmd.exe	34
PID 3052 wrote to memory of 2752	3052	cmd.exe	34
PID 2568 wrote to memory of 2980	2568	Neobot.exe	35
PID 2568 wrote to memory of 2980	2568	Neobot.exe	35
PID 2568 wrote to memory of 2980	2568	Neobot.exe	35
PID 2980 wrote to memory of 2368	2980	cmd.exe	37
PID 2980 wrote to memory of 2368	2980	cmd.exe	37
PID 2980 wrote to memory of 2368	2980	cmd.exe	37
PID 2568 wrote to memory of 2060	2568	Neobot.exe	38
PID 2568 wrote to memory of 2060	2568	Neobot.exe	38
PID 2568 wrote to memory of 2060	2568	Neobot.exe	38
PID 2568 wrote to memory of 2324	2568	Neobot.exe	40
PID 2568 wrote to memory of 2324	2568	Neobot.exe	40
PID 2568 wrote to memory of 2324	2568	Neobot.exe	40

C:\Users\Admin\AppData\Local\Temp\5ae48ab82599784bec09e3ebb23f979b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ae48ab82599784bec09e3ebb23f979b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\Neobot.exe
  "C:\Users\Admin\AppData\Local\Temp\Neobot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:2752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Neobot.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Neobot.exe C:\Users\Admin\AppData\Local\Temp\Neobot.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:2368
  - - C:\Windows\system32\netsh.exe
      "netsh.exe" firewall set opmode disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2060
  - - C:\Windows\System32\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Neobot.exe

Filesize
207KB

MD5
38ab874c62ef471d88231f004822a1c1

SHA1
5544780eb6aceaa6138f79e69716605a1c44df9f

SHA256
0adfcd1228dc34446d112d20085302c786f456e959c710f00a0640a587789428

SHA512
0d684ab96d99a530a31c33d84b22a6ca2e4c21ef52c941dd3bc044643fe149beab42cf7529e36948ce51474a3f18be772172e41786da4274877abf5244299ca7

Download Submit
memory/1732-7-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/1732-8-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/1732-9-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/1732-11-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/1732-13-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/1732-12-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/1732-19-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-0-0x000007FEF631E000-0x000007FEF631F000-memory.dmp

Filesize
4KB

Download
memory/2876-3-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download
memory/2876-10-0x000007FEF6060000-0x000007FEF69FD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads