3fd2b975ad9fc6327f0c0a3b29789605931c1c14964d607754611183aff1ee61

General

Target

f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe
Size

559KB
MD5

f7dfdf82fa9bedf1442c446885fc8d6b
SHA1

72aa690361cf1e7a8669f5b1c8e5f224877287c1
SHA256

3fd2b975ad9fc6327f0c0a3b29789605931c1c14964d607754611183aff1ee61
SHA512

162f97d671396328ca8d22dd8adbd9d963688b0107142826f60d2b17313eff7f2b1f17491e398c98a8a7e79c1414caba1fc0b397cd96df74601bae0b133caefb
SSDEEP

6144:7BtLHIAXJrEG9w+z9f3vMv92loae4DmA8sIMLnWXAqM65n1Gl25Zk/yxvU5Qr6XY:fHIAXxEG9VfE9AVfDWX5Gc5ZUyObN

Score

7^/10

collection persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exesinst.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	sinst.exe

Executes dropped EXE 2 IoCs

Processes:

mail.exedial.exe

pid process

2164 mail.exe
552 dial.exe

pid	process
2164	mail.exe
552	dial.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\sin st\mail.exe	upx
behavioral2/memory/2164-16-0x0000000000400000-0x0000000000416000-memory.dmp	upx
C:\Windows\SysWOW64\sin st\dial.exe	upx
behavioral2/memory/2164-25-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/552-26-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/552-27-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mail.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mail.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

sinst.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sinst = "C:\\Windows\\SysWOW64\\sinst.exe"	sinst.exe

Drops file in System32 directory 5 IoCs

Processes:

dial.exesinst.exemail.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sin st\dial.txt	dial.exe
File opened for modification	C:\Windows\SysWOW64\sin st\dial.txt	dial.exe
File created	C:\Windows\SysWOW64\sin st\mail.exe	sinst.exe
File created	C:\Windows\SysWOW64\sin st\dial.exe	sinst.exe
File created	C:\Windows\SysWOW64\sin st\mail.txt	mail.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe

pid process

4692 f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe

pid	process
4692	f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exesinst.exe

description	pid	process	target process
PID 4692 wrote to memory of 3548	4692	f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe	sinst.exe
PID 4692 wrote to memory of 3548	4692	f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe	sinst.exe
PID 4692 wrote to memory of 3548	4692	f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe	sinst.exe
PID 3548 wrote to memory of 2164	3548	sinst.exe	mail.exe
PID 3548 wrote to memory of 2164	3548	sinst.exe	mail.exe
PID 3548 wrote to memory of 2164	3548	sinst.exe	mail.exe
PID 3548 wrote to memory of 552	3548	sinst.exe	dial.exe
PID 3548 wrote to memory of 552	3548	sinst.exe	dial.exe
PID 3548 wrote to memory of 552	3548	sinst.exe	dial.exe

C:\Users\Admin\AppData\Local\Temp\f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7dfdf82fa9bedf1442c446885fc8d6b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\sinst.exe
"C:\Windows\system32\sinst.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3548

C:\Windows\SysWOW64\sin st\mail.exe
"C:\Windows\SysWOW64\sin st\mail.exe" /stext "C:\Windows\SysWOW64\sin st/mail.txt"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Drops file in System32 directory
PID:2164

C:\Windows\SysWOW64\sin st\dial.exe
"C:\Windows\SysWOW64\sin st\dial.exe" /stext "C:\Windows\SysWOW64\sin st/dial.txt"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sin st\dial.exe
Filesize
39KB

MD5
d36cec48ea68809c3bc9b2649158e953

SHA1
6763c500e815907361a13707eb1b4129feef93a5

SHA256
e4e5e1e3b65f9532fff19402e8ff7d060db971da0a9fc11aa56f159f46ebbb41

SHA512
0c6307847de847edba13d2da37987844b9fa660aada67869c8b845523a8c6013aca6180d649f5b2e8ea6113cdfb5af8e625f66cdb08a6ab66bd0f0c865b87dc9

Download Submit
C:\Windows\SysWOW64\sin st\mail.exe
Filesize
32KB

MD5
105f3bc196b09346bb002bd09ebba661

SHA1
d214f233b32beb1d72b402911ac0a6979ae5ad80

SHA256
57c16dc62641cb315373c6284a8027442432e58d900d6107fe453263a0adcfd1

SHA512
16805ebe7332f0b961ad4743242f76003294bf2f520e5b0b120a9bf5e784bd1c483a046fe301bf41e4682e9fdf59d37f3743d82ff445e58e0bc6903e2ea8ae4b

Download Submit
memory/552-26-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/552-27-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2164-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2164-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3548-1-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3548-28-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3548-29-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3548-34-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3548-35-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4692-0-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads