1b156ec9dee4dd78c518dc0609bfffffb49d3a1ccf5953e6a8906a38070c1508

General

Target
76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
Size 7.7MB
Sample240526-yqt7dsba67
SHA256 1b156ec9dee4dd78c518dc0609bfffffb49d3a1ccf5953e6a8906a38070c1508
MD5 76a76bcb5619ae20253bec9a8d656e10
SHA1 39786e0eab23d2e4367165be8f2c428081364b71
SHA512 d14f52bf8a0e6fa099b44b8447d9cc8fd38b50fb100a487388898602d391e1b0509646b4bda6b98419d6f552147fc3391cfed332405322a50a8710f97c16e78b
SSDEEP 196608:0RLpA0Px4xrfgIRWta9aQHEGdY1ub0eN1y3/K1:CpA8x4xDHRwQddY1I0eryC1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4496	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022ac7-25.dat	acprotect
behavioral2/memory/3372-29-0x0000000073C80000-0x0000000073C89000-memory.dmp	acprotect

Loads dropped DLL 6 IoCs

pid	Process
3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022ac7-25.dat	upx
behavioral2/memory/3372-29-0x0000000073C80000-0x0000000073C89000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4496	3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe	82
PID 3372 wrote to memory of 4496	3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe	82
PID 3372 wrote to memory of 4496	3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe	82
PID 3372 wrote to memory of 1572	3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe	84
PID 3372 wrote to memory of 1572	3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe	84
PID 3372 wrote to memory of 1572	3372	76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\76a76bcb5619ae20253bec9a8d656e10_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\netsh.exe
  netsh.exe advfirewall firewall delete rule name="all" remoteip=95.141.193.133
  2⤵
  - Modifies Windows Firewall
  PID:4496
- C:\Windows\SysWOW64\route.exe
  route.exe delete 95.141.193.133
  2⤵
  PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aero.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\Aero.dll
Size 6KB
SHA256 b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c
MD5 869c5949a10b32d3a31966cc5291301b
SHA1 329080c974d593ecdefd02afa38dd663a10331c4
SHA512 3b9dde16e9ca803b1048243dbf29c717ac0472dffa764542c234318a960828834aa650b1dfb8bba66c4e7a9ce3aaf453829afc57dfb33dc8c311d203150d4fca
SSDEEP 96:AdxrhBuDBzndge+Kwv7KzxsJBuEGQKq+5okMU+S0767ZJG:IGB+Bh78xsPLGQKqEokSS0e7ZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\LangDLL.dll
Size 5KB
SHA256 47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
MD5 a1cd3f159ef78d9ace162f067b544fd9
SHA1 72671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA512 ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
SSDEEP 48:apTVWFeApYx2lxaKe3yfeEIWCGWNpBWLGGrx3pMt4z8mtJ7HofYZVSLa:RFG0xaKkyfjIWTW7BYrhSbmtJ7/V
MD5 SHA1 SHA512 SSDEEP

Submit Download

newadvsplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\newadvsplash.dll
Size 8KB
SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
MD5 55a723e125afbc9b3a41d46f41749068
SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\nsDialogs.dll
Size 9KB
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\nsExec.dll
Size 6KB
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

repackme.gif

Path C:\Users\Admin\AppData\Local\Temp\nsb55D3.tmp\repackme.gif
Size 6KB
SHA256 82a1454402156d74f4f23c992d5d772b665546208eff44790871b8dcb36d2304
MD5 23d3840adb8f4f1efc083a1f7e640191
SHA1 adf0c7daa49637767b2abe2f390d1da4780eea9c
SHA512 7743a17141581ffa8023097678bf2eaf6db7d337af45052d00caba74f21f13e7ffa95097b629c3a28a3366eda873afdce240344adfdf7c0ef662a0ba0fe6db25
SSDEEP 192:fteOIrvvT8hZesyvs3ukkz3naFK5ES3kI:fwTjTqR3rkzqFKeSUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3372-29-0x0000000073C80000-0x0000000073C89000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads