7c1c73ab42696e39505979ff9238b35a3c4bd60dda2576ba8770cd7a297c37d7

General

Target

5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe
Size

172KB
MD5

5b0ea51e95974f2df1524a19d798c422
SHA1

21e2ffb6e2d230736847548795cbc7fb6e59c136
SHA256

7c1c73ab42696e39505979ff9238b35a3c4bd60dda2576ba8770cd7a297c37d7
SHA512

bf02f4e9b3e4a65dd3f3272168ab88b7ab894a5ecbe72c92f68362953c40f7fb3c116fbd59c41095602ff796084cf0ab313e8a7eb855ee54410ec3e11cb38da0
SSDEEP

3072:H2YOj+Rd/HB7oV7HV3ffDoStyMhV5HRHULEZ3+1/9qOFzk:hOj+rWJffMWhV5HRHUgItFz

Score

8^/10

evasion execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npi.sys	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3864	netsh.exe
2352	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\npii\parameters\servicedll = "C:\\Windows\\system32\\npi.dll"	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
2348	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\npi.dll	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1264	sc.exe
2268	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\internet explorer\main	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\TI = "TI"	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	svchost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 920	4832	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	89
PID 4832 wrote to memory of 920	4832	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	89
PID 4832 wrote to memory of 920	4832	5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe	89
PID 920 wrote to memory of 3864	920	cmd.exe	91
PID 920 wrote to memory of 3864	920	cmd.exe	91
PID 920 wrote to memory of 3864	920	cmd.exe	91
PID 920 wrote to memory of 2352	920	cmd.exe	92
PID 920 wrote to memory of 2352	920	cmd.exe	92
PID 920 wrote to memory of 2352	920	cmd.exe	92
PID 920 wrote to memory of 1264	920	cmd.exe	94
PID 920 wrote to memory of 1264	920	cmd.exe	94
PID 920 wrote to memory of 1264	920	cmd.exe	94
PID 920 wrote to memory of 808	920	cmd.exe	95
PID 920 wrote to memory of 808	920	cmd.exe	95
PID 920 wrote to memory of 808	920	cmd.exe	95
PID 920 wrote to memory of 1524	920	cmd.exe	96
PID 920 wrote to memory of 1524	920	cmd.exe	96
PID 920 wrote to memory of 1524	920	cmd.exe	96
PID 920 wrote to memory of 4516	920	cmd.exe	97
PID 920 wrote to memory of 4516	920	cmd.exe	97
PID 920 wrote to memory of 4516	920	cmd.exe	97
PID 920 wrote to memory of 2268	920	cmd.exe	98
PID 920 wrote to memory of 2268	920	cmd.exe	98
PID 920 wrote to memory of 2268	920	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b0ea51e95974f2df1524a19d798c422_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "%temp%\npi.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram name="npi" program="C:\Windows\system32\svchost.exe" mode=enable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3864
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add portopening tcp 8085 npi enable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2352
- - C:\Windows\SysWOW64\sc.exe
    sc create "npii" type= share start= auto binpath= "C:\Windows\system32\svchost.exe -k npii"
    3⤵
    - Launches sc.exe
    PID:1264
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\system\currentcontrolset\services\npii\parameters" /v servicedll /t reg_expand_sz /d "C:\Windows\system32\npi.dll" /f
    3⤵
    - Server Software Component: Terminal Services DLL
    PID:808
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\system\currentcontrolset\services\npii" /v failureactions /t reg_binary /d 00000000000000000000000003000000140000000100000060ea00000100000060ea00000100000060ea0000 /f
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\svchost" /v npii /t reg_multi_sz /d "npii\0" /f
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc start npii
    3⤵
    - Launches sc.exe
    PID:2268

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k npii -s npii
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\npi.bat

Filesize
676B

MD5
8a8f907dad97578ff215aa154b8ea057

SHA1
23bf74b5fb95bc4a5d4a12d7b09f5a5f090567e1

SHA256
d839647d36425306ef0c961580d1b978ce72bf0956c1ff7bebc8bcc81b4849a5

SHA512
43aeaf2b9ca0888e513c318a05f30cc516b0d70e96d09429180e7c58772e58a1117b95d6ace80a121fdc8d1fdc8114c3d5a21d447fca7e512181226ffc4e181b

Download Submit
\??\c:\windows\SysWOW64\npi.dll

Filesize
49KB

MD5
4e56104661bb20c34e9c9516ccd9f79c

SHA1
aa9d95a438a019304d03bf097060ce719f883442

SHA256
bf8b85e9f6667ddec0675c354d21080d535f460bc2e1f742e11374ec6609e2a4

SHA512
cb5d392dbf4f55aab04d2bd91a4c55cde3e3d094506b607b78b5fcb4ccca216d2f1560f9afe465f04da4f9a594cfb19c26b354273bc75c98c5c229a3cfae9003

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads