83ab0e632ed6a27dac4240ed2a4bc7dc59063cd4c399c7e661283579070107c6

General

Target

5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe
Size

328KB
MD5

5fb949ba83463d4e0d1bd4a97e0565cc
SHA1

17d8cfd7e2430b9f41f771d3f8e6895da0bd213b
SHA256

83ab0e632ed6a27dac4240ed2a4bc7dc59063cd4c399c7e661283579070107c6
SHA512

b2a0cedc4b0964b35004e1e93a95a0220db8c2f0ae24c73fd3b7aeaeb218286f98956ae9e6a2af73828314f12c61ff6cbb61455785a7cde721db8ef8fbaf1d1c
SSDEEP

6144:2vHTbnUcT+eNrI7DfpNsGscL6j4XrOtvcVhHO7/IerxRo7vU:2vzbnUreADjvkE7OtvchI1c7vU

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2832	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	unszfigy.exe

Loads dropped DLL 4 IoCs

pid	Process
2832	cmd.exe
2832	cmd.exe
2684	unszfigy.exe
2684	unszfigy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2568	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2208	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2684	unszfigy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	unszfigy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2684	unszfigy.exe
2684	unszfigy.exe
2684	unszfigy.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2684	unszfigy.exe
2684	unszfigy.exe
2684	unszfigy.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2832	1708	5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe	30
PID 1708 wrote to memory of 2832	1708	5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe	30
PID 1708 wrote to memory of 2832	1708	5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe	30
PID 1708 wrote to memory of 2832	1708	5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe	30
PID 2832 wrote to memory of 2568	2832	cmd.exe	32
PID 2832 wrote to memory of 2568	2832	cmd.exe	32
PID 2832 wrote to memory of 2568	2832	cmd.exe	32
PID 2832 wrote to memory of 2568	2832	cmd.exe	32
PID 2832 wrote to memory of 2208	2832	cmd.exe	34
PID 2832 wrote to memory of 2208	2832	cmd.exe	34
PID 2832 wrote to memory of 2208	2832	cmd.exe	34
PID 2832 wrote to memory of 2208	2832	cmd.exe	34
PID 2832 wrote to memory of 2684	2832	cmd.exe	35
PID 2832 wrote to memory of 2684	2832	cmd.exe	35
PID 2832 wrote to memory of 2684	2832	cmd.exe	35
PID 2832 wrote to memory of 2684	2832	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1708 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5fb949ba83463d4e0d1bd4a97e0565cc_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\unszfigy.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 1708
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2208
- - C:\Users\Admin\AppData\Local\unszfigy.exe
    C:\Users\Admin\AppData\Local\unszfigy.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\unszfigy.exe

Filesize
328KB

MD5
5fb949ba83463d4e0d1bd4a97e0565cc

SHA1
17d8cfd7e2430b9f41f771d3f8e6895da0bd213b

SHA256
83ab0e632ed6a27dac4240ed2a4bc7dc59063cd4c399c7e661283579070107c6

SHA512
b2a0cedc4b0964b35004e1e93a95a0220db8c2f0ae24c73fd3b7aeaeb218286f98956ae9e6a2af73828314f12c61ff6cbb61455785a7cde721db8ef8fbaf1d1c

Download Submit
memory/1708-0-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/1708-5-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/1708-4-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/1708-2-0x0000000001001000-0x00000000010C0000-memory.dmp

Filesize
764KB

Download
memory/1708-7-0x0000000001001000-0x00000000010C0000-memory.dmp

Filesize
764KB

Download
memory/1708-8-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-18-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-23-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-13-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-16-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-15-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-21-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-22-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-14-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-24-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-26-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-27-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-28-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-29-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download
memory/2684-30-0x0000000001000000-0x00000000010D4000-memory.dmp

Filesize
848KB

Download

Analysis

Sharing