62e612131fe5450066082a3aac5bb2bbfd5a80f62a5f4eff59d3625314a8abca

General

Target

66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe
Size

224KB
MD5

66d30a72dfa7f667f800e658c13676b9
SHA1

59382cc5b29873d777e31a2275070acf74590e8e
SHA256

62e612131fe5450066082a3aac5bb2bbfd5a80f62a5f4eff59d3625314a8abca
SHA512

bd798f3447b7932d4dc75e2996cf9cecda31a7e9364e7b63f3d6784f076aa0a74ba0e97031ddacf187ad14b89678c06cfe37e57023432a02c544695a1de9e1b4
SSDEEP

3072:xLjbPOaMhkfu7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrXLMRR4vKvblBQjS2out:NPtIbNkVsuaRaU6mHGbMRR4vQ+W2oS

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~DFA8650.tmp	acprotect

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1904 regsvr32.exe
2240 regsvr32.exe

pid	process
1904	regsvr32.exe
2240	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\~DFA8650.tmp	upx
behavioral2/memory/2240-17-0x0000000011000000-0x0000000011032000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\mswinsck.ocx 66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

Processes:

66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe
File opened for modification	C:\Windows\sys.dat	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ = "P2P"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\~DFA8650.tmp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Es58.P2P\ = "Es58.P2P"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ = "_P2P"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\ProgID\ = "Es58.P2P"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ = "_P2P"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\ = "Es58.P2P"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\TypeLib\ = "{52DAF8C9-8861-47A8-BC17-077666A2342A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Es58.P2P	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{52DAF8C9-8861-47A8-BC17-077666A2342A}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3FAF77B7-5DD0-45E7-A92A-8C92F95D2964}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94A1ADBF-7F8D-4B8A-B3FA-48E69CB4C804}\Programmable	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

pid process

4540 66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

pid	process
4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe

description	pid	process	target process
PID 4540 wrote to memory of 1904	4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe	regsvr32.exe
PID 4540 wrote to memory of 1904	4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe	regsvr32.exe
PID 4540 wrote to memory of 1904	4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe	regsvr32.exe
PID 4540 wrote to memory of 2240	4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe	regsvr32.exe
PID 4540 wrote to memory of 2240	4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe	regsvr32.exe
PID 4540 wrote to memory of 2240	4540	66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66d30a72dfa7f667f800e658c13676b9_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\mswinsck.ocx"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:1904
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\~DFA8650.tmp"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DFA5595.tmp

Filesize
7KB

MD5
99adf79c30f1eff0f307f939f7a6bc41

SHA1
d3acb913bbd95a01a5531f373ac14d965860e259

SHA256
8ca95aab36584b193f757207349f1f4e5ecf7155b3efa4226b81706a700a6b3b

SHA512
0af6b0533c3196e138aee0cabaf2d979ab37b3f1c79616d90eebb13f23e355a753c858f30e79a4807803136ebbd9401050c6dd8c62ac6c639dd501908348f7ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA8650.tmp

Filesize
48KB

MD5
73e40295ab0e0c740b114b9251042b87

SHA1
e057bc7de709e34e9ae666fdb713708f038af819

SHA256
1c208796cd09557fe2d0a375f30a2feb49b45af8661798ab0046883cd68d54fd

SHA512
883171d6108e1d2a62437a2a37b84b9d33b22737eaead2355bdeccf028e0fbb5491e45087f7c397f58adf4837e43fd3a410c47d78426bf90669d71025e4a6b98

Download Submit
C:\Windows\SysWOW64\mswinsck.ocx

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
C:\Windows\sys.dat

Filesize
6KB

MD5
ac020253a7b53b2ea390c39718c8c1c4

SHA1
65d90e272d6c1643d0c887ba4e0fb376fc01db05

SHA256
373ca2c1e2639036d5326cd3e6fc616a9d2ebdfba99dbbeea7764448c4b3ede8

SHA512
4f6684e178e707da612a819fa1ca43c725125a93053f8eb6b30c05cbfa658dd30b4215a3a23d6471ce2ff8e55197f63a6e3c30022bf28cdf5d71b18b7b9d95c3

Download Submit
memory/2240-17-0x0000000011000000-0x0000000011032000-memory.dmp

Filesize
200KB

Download
memory/4540-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads