15ff89eeadd065236e7c65ae68e261c5a527434294b237af3274c149974bfd2b

General

Target

4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe
Size

700KB
MD5

4ac6ea876e2d9bd5df21475490ffa8a5
SHA1

f570a239fbb1e64790bcd7c2359d29228a579bbc
SHA256

15ff89eeadd065236e7c65ae68e261c5a527434294b237af3274c149974bfd2b
SHA512

f462248a4fb53677e9c78f5b06e468aaf2ec7ba726c8daa07287647e00815a80c60eaf643c8967ae65f3ac542df37fc898d7da21a8105178d588785dcb6eff49
SSDEEP

12288:cMJfsG35xx2yDGl5yfPgSPSs4/dXlDRoZVIlBPQhfE8P5imFJH:cMJfsKWyDwi6scdX1RsVwhKPXF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2212-4-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-5-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-1-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-82-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-85-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-84-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-83-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-86-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-105-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-107-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-120-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-121-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-119-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-122-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-129-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-126-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-130-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-131-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-136-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-148-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-149-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-162-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-163-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-164-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx
behavioral1/memory/2212-166-0x0000000001D50000-0x0000000001E9C000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~2\is259430286.log	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe
2212	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2212	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2212	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe
2212	4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4ac6ea876e2d9bd5df21475490ffa8a5_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ish259428477\bootstrap_23462.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\css\main.css

Filesize
6KB

MD5
794b69d3ab52585d981eac66f37e492f

SHA1
6c18c542e2e456d1e08635aa21f00a8a4e755b69

SHA256
b18b44d77a39148df4fa0c528f9ef85e9ee2253cee52746fb8f6988cb63828cf

SHA512
cecfae076152c03a7dcd4b14ff7f59f6f224094fb12e9a47803c8fc6a2eea52c5adedd49686dd78ba5edbd31e8f80c22eaea37c0a1e71601ad5a461d17ce57a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\images\BG.png

Filesize
86KB

MD5
c6b4da4b27ba612bf72fdf4cb53af433

SHA1
b194f471c600c8dc94fd9405b7bcdd62a60f600b

SHA256
e1ae28755e9f0c6eaec0ad8daa3ff43e5811409de2c94341b09946b5d599032f

SHA512
acf36640b1f567aabf8a0f660e921629060a5502650ba3514be5f458fd869290568cc8cbc63a2b69d527573d1df41c906327b01e049cdc052bd390fb6797c6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\images\Close.png

Filesize
1KB

MD5
b5680d31a09579da2f6e57dd2dc4b525

SHA1
caa1ebc4abbc86cdf33ef0cb496ee54f2c475575

SHA256
937a69b5d26a5dcacb1b81cd90a2d05fd55618af4e32a7f2e9550449f4163bbc

SHA512
d4a95c723b810355fb744120fb38660076b1724e6203c1f10f92165d2f097148bfa639279f933af329c44d8a1ed0eecaecbcad16f6502229ce3212fa50161ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\images\Color_Button.png

Filesize
846B

MD5
f6a0a0c082bc7ddc1e0e599493949e1f

SHA1
73b63bb6233e0e27b58ccdcb4ac32b05e36ce046

SHA256
b01fb9069f905b1f8ec3b72937e1a7a415fa62ee289aa79c68f65eee43bdd762

SHA512
ed5176bb258835a6346322a0ec0564557da28484a7bcc014ad1fcc337b14518b98e37475e41e6ae29cb724333e1c8471dd0f48bcf2a0d4cff522fb15e097716b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\images\Grey_Button.png

Filesize
1KB

MD5
aa1424f218bf3befbcca3c4c0e42a365

SHA1
c91d5dce4ebd543d905026577f8a05dff1d8357e

SHA256
e1a823582add59d1406fd36d3f7f86f98873e3201168e542cb49239d6c525ab0

SHA512
8ef2ea9613ff50bf028c9ef4611326d61b1cd07d01b89631faa2053449fab9a746e06e59a176dd5cda4f02f77fca8eedbb6e46ae4a78afa416ae8adb7ef0d93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428477\images\Loader.gif

Filesize
10KB

MD5
57ca1a2085d82f0574e3ef740b9a5ead

SHA1
2974f4bf37231205a256f2648189a461e74869c0

SHA256
476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

SHA512
2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

Download Submit
memory/2212-83-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-130-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-0-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/2212-84-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-85-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-105-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-107-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-120-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-121-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-119-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-122-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-129-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-126-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-86-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-131-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-136-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-82-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-1-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2212-5-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-4-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-148-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-149-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-162-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-163-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-164-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download
memory/2212-166-0x0000000001D50000-0x0000000001E9C000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing