e55725f5fbf84e6bef8fe5099d52c818f252a5a042c052829930f5d240fb28c8

General

Target

f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
Size

25.8MB
MD5

f1c5f170fa31ddf34644181b4e487b83
SHA1

da79ff32504c28ced361d37be0574aa8c74febe5
SHA256

e55725f5fbf84e6bef8fe5099d52c818f252a5a042c052829930f5d240fb28c8
SHA512

840685e71428072c9e3beca925054c0c040b6f46c1b4a782df07ff735c91535d2ebd08d11c4db7ecb0186a7cfd04d8d6ea884e4cb14f41fc987901e79d5626a7
SSDEEP

786432:lUpy6VrdoJEimccvNyd0xix2tOLEXXCfcv6rlEJ4Pvd:lqy6cJdGm0FOwHo46ZEAd

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000017090-5.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1288	h2o.exe

Loads dropped DLL 10 IoCs

pid	Process
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
1288	h2o.exe
1288	h2o.exe
1288	h2o.exe
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000017090-5.dat	upx
behavioral1/memory/2228-7-0x0000000001ED0000-0x0000000001F90000-memory.dmp	upx
behavioral1/memory/2228-48-0x0000000003880000-0x0000000003940000-memory.dmp	upx
behavioral1/memory/2228-49-0x0000000001ED0000-0x0000000001F90000-memory.dmp	upx
behavioral1/memory/2228-50-0x0000000003880000-0x0000000003940000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30
PID 2228 wrote to memory of 1288	2228	f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1c5f170fa31ddf34644181b4e487b83_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\h2o.exe
  "C:\Users\Admin\AppData\Local\Temp\h2o.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLC5947.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
\Users\Admin\AppData\Local\Temp\GLK5B7B.tmp

Filesize
298KB

MD5
dc5ddc1491bec6d442920153de41e6fc

SHA1
f3892b1d0f9d37ccb20dc9a8ab957783061715fe

SHA256
8c8156f09d01f64559bd8c9c5bdec13d723093598eb664c0923402ddc0bab156

SHA512
8da36f9b98832734a60e401de3a98c1dc9a73308596746b54aca2183c4ed1fa98fe92c3d41a2d6c50eceddcba3bfb0823824408433cdcc707860f2d78b2c8ab4

Download Submit
\Users\Admin\AppData\Local\Temp\h2o.exe

Filesize
349KB

MD5
b53c6a9fbaec6876219c9c481fc0113d

SHA1
43918ed1d2540fb16c9bc315fdf672321923b417

SHA256
e5682985bbf9e39175d6ad628b20d350aaed58d4b2e91f29c099b193a66be61c

SHA512
3f97998e2873664703e453be65b35f07655c03cce74cc7fcf461c5bd1651712a6c558537f4c6c520782a2076808af3be68422f3280383c62e7bbbb2c92e408ea

Download Submit
memory/1288-38-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1288-77-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1288-53-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1288-30-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1288-35-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1288-37-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2228-21-0x0000000003A50000-0x0000000003ABE000-memory.dmp

Filesize
440KB

Download
memory/2228-48-0x0000000003880000-0x0000000003940000-memory.dmp

Filesize
768KB

Download
memory/2228-49-0x0000000001ED0000-0x0000000001F90000-memory.dmp

Filesize
768KB

Download
memory/2228-50-0x0000000003880000-0x0000000003940000-memory.dmp

Filesize
768KB

Download
memory/2228-28-0x0000000003A60000-0x0000000003ACE000-memory.dmp

Filesize
440KB

Download
memory/2228-75-0x0000000003A50000-0x0000000003ABE000-memory.dmp

Filesize
440KB

Download
memory/2228-76-0x0000000003A50000-0x0000000003ABE000-memory.dmp

Filesize
440KB

Download
memory/2228-7-0x0000000001ED0000-0x0000000001F90000-memory.dmp

Filesize
768KB

Download

Analysis

Sharing