0aef999386f2e78feb0597d96dc395f59ff40128ee80fbeaef82a1af643b3cd1

General

Target

65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
Size

731KB
MD5

65db1ed7a70e9f5c9278f7ee2467af10
SHA1

fa748afc18507d19b3557ad430cfb1ab2259c1c6
SHA256

0aef999386f2e78feb0597d96dc395f59ff40128ee80fbeaef82a1af643b3cd1
SHA512

f98aebe4162cd1dddf6904b6a8e1d941d5730e311060b3f781c33394ad86e62459e35582f4522b1155858e1661000d58d3b2ea503057c9f84ead6e45df006bf6
SSDEEP

12288:Jaingtd/9iCpVEZxzraxdUdpm1FmjnDgGeIttwoPR5pWZhAIRXHYnrm5:JaigD/ArravUds1wnlFttwYQRXHYrm5

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2052	netsh.exe
2740	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2168	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2168	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2168	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2168	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2116	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2116	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2116	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2116	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2796	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2796	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2796	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2796	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	32
PID 2796 wrote to memory of 2052	2796	cmd.exe	34
PID 2796 wrote to memory of 2052	2796	cmd.exe	34
PID 2796 wrote to memory of 2052	2796	cmd.exe	34
PID 2796 wrote to memory of 2052	2796	cmd.exe	34
PID 2240 wrote to memory of 2656	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2656	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2656	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2656	2240	65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe	35
PID 2656 wrote to memory of 2740	2656	cmd.exe	37
PID 2656 wrote to memory of 2740	2656	cmd.exe	37
PID 2656 wrote to memory of 2740	2656	cmd.exe	37
PID 2656 wrote to memory of 2740	2656	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2740