a190817db0b96037545737db585c08bac0d1190fec83a454c23a85fad2e7df33

General

Target

63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
Size

214KB
MD5

63fe01015f4ceb19c9b64ad0bccc723b
SHA1

cc2a9fb065871024e41c20dca051f3e416677c89
SHA256

a190817db0b96037545737db585c08bac0d1190fec83a454c23a85fad2e7df33
SHA512

5ec98e2215d88552af88ae5b0feaf8a0e390080e3150cfb20ce439fb0064f8ef2fe9c0b963de0e9cc6bc93f0cbdd4dc6950138e878005b8901c07a35438c40b5
SSDEEP

6144:hr8BPOXg3B5eDyV9/ZxoqiLB2wS4hcu8Fq:hr8PKgx5rV9/ZmLBy4IFq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2892	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 2892	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
Token: SeDebugPrivilege	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1204	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	21
PID 2564 wrote to memory of 332	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	2
PID 332 wrote to memory of 2824	332	csrss.exe	30
PID 332 wrote to memory of 2824	332	csrss.exe	30
PID 2564 wrote to memory of 2892	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2892	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2892	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2892	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2892	2564	63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe	31
PID 332 wrote to memory of 852	332	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:852
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\63fe01015f4ceb19c9b64ad0bccc723b_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
1058cba963a5704f50dcc182f8615fde

SHA1
8a4e5cb50c94200a9d5fb1a40d1247c6039e87a8

SHA256
af8f833575eab9469f1bca9ac441f7d8952162a36f5e8a9fdf76b7539e32b7a6

SHA512
665c886985cdbe8c70ca53d6333d8638534880b4bae811632b92fef119ea89e231552ead94d04e22a639c27e623184f0f62dc5b2bca47cb71fd30774aeae5f3c

Download Submit
memory/332-29-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download
memory/332-20-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/332-28-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/332-21-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download
memory/332-19-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download
memory/852-41-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/852-39-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download
memory/852-35-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download
memory/852-43-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/852-45-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/852-40-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/852-31-0x0000000000230000-0x000000000023B000-memory.dmp

Filesize
44KB

Download
memory/852-44-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/1204-8-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/1204-4-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/1204-13-0x0000000002AC0000-0x0000000002AC2000-memory.dmp

Filesize
8KB

Download
memory/1204-12-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/2564-27-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2564-26-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2564-25-0x0000000000415000-0x0000000000419000-memory.dmp

Filesize
16KB

Download
memory/2564-24-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2564-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2564-3-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2564-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2564-1-0x0000000000415000-0x0000000000419000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing