bb9945699dd4914b2f66c299f895d58ebcbd3faae7cd1ad2c55e8b1089c414ea

General

Target

018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Size

1.8MB
MD5

018aeffc198ecf3b019b668b571d5080
SHA1

55b1a3662b97753a3561d0ddb79ba16a4aa0129d
SHA256

bb9945699dd4914b2f66c299f895d58ebcbd3faae7cd1ad2c55e8b1089c414ea
SHA512

8753abb0da0a63e4bcb69d235b73c7b2321c2ee99662f5338d3ca2004f598b3ee002385b85d3b8c20e68919dfa7379bfbc9481a985c16f979cf556c022561b0e
SSDEEP

49152:vAyzOBI5jhmE+6sWJVFiQfhpueQap1HXIJB:vxOBI58E+NWJT6eQap1HXIJB

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 1 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key security queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key security queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeSecurityPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeBackupPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeRestorePrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeShutdownPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeDebugPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeUndockPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: 33	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: 34	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: 35	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
Token: 36	1856	018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\018aeffc198ecf3b019b668b571d5080_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-1-0x0000000000940000-0x000000000097B000-memory.dmp

Filesize
236KB

Download
memory/1856-2-0x0000000000820000-0x0000000000822000-memory.dmp

Filesize
8KB

Download
memory/1856-3-0x000000000041B000-0x000000000041C000-memory.dmp

Filesize
4KB

Download
memory/1856-4-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/1856-6-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/1856-5-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/1856-7-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/1856-8-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/1856-9-0x0000000000940000-0x000000000097B000-memory.dmp

Filesize
236KB

Download
memory/1856-10-0x000000000041B000-0x000000000041C000-memory.dmp

Filesize
4KB

Download
memory/1856-11-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads