764e65973f6af7504805f37b978731ce6e1f1b343a1e6cd8dbcfaf6109f26793

General

Target

653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe
Size

731KB
MD5

653218455327860302b6ad73c43d6eb2
SHA1

543556a38fd5c97b2a4e44d8825e8bce44949373
SHA256

764e65973f6af7504805f37b978731ce6e1f1b343a1e6cd8dbcfaf6109f26793
SHA512

3530fd2dcd131afb21962d437e3b09fca0da469911b2e16d2248bcefb5c3475f62f3f3c1b96649b623ac8a51fcb4f83448166d93c22ea57e7355360b85253f80
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpmkFmjnDgGeIttwoPR5pWZhAIRXHYnrm+:JaigD/ArravUdskwnlFttwYQRXHYrm+

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2876	netsh.exe
2812	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2904	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	29
PID 2568 wrote to memory of 2904	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	29
PID 2568 wrote to memory of 2904	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	29
PID 2568 wrote to memory of 2904	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	29
PID 2568 wrote to memory of 2316	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2316	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2316	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2316	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	31
PID 2568 wrote to memory of 2852	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	33
PID 2568 wrote to memory of 2852	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	33
PID 2568 wrote to memory of 2852	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	33
PID 2568 wrote to memory of 2852	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	33
PID 2852 wrote to memory of 2876	2852	cmd.exe	35
PID 2852 wrote to memory of 2876	2852	cmd.exe	35
PID 2852 wrote to memory of 2876	2852	cmd.exe	35
PID 2852 wrote to memory of 2876	2852	cmd.exe	35
PID 2568 wrote to memory of 2836	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	36
PID 2568 wrote to memory of 2836	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	36
PID 2568 wrote to memory of 2836	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	36
PID 2568 wrote to memory of 2836	2568	653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe	36
PID 2836 wrote to memory of 2812	2836	cmd.exe	38
PID 2836 wrote to memory of 2812	2836	cmd.exe	38
PID 2836 wrote to memory of 2812	2836	cmd.exe	38
PID 2836 wrote to memory of 2812	2836	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\653218455327860302b6ad73c43d6eb2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2812