e54c186fc800291a078165aa454cbe839d5a6795859991175308c7d2a189f061

General

Target

79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
Size

904KB
MD5

79b2583a841d74473396b4fef58ae663
SHA1

22cb5eb8a31725ade3ad749aeb669429f0531c3a
SHA256

e54c186fc800291a078165aa454cbe839d5a6795859991175308c7d2a189f061
SHA512

5e9250fbb55ce6c7552a9d17ab9ea10276cafca0b529574283e842e0d321ce55b411f2b8e6de987b21f5bff8d53b0c25f409daafd1cc6df63ef4d947a3037233
SSDEEP

24576:r+Fw2IgKTiyqJy0KK/MOBFR0hkD1X5fluEq2i53rlVgi:r6w2NKmyqJyxLgFR7D1X5YlJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2912	youbo.exe

Loads dropped DLL 11 IoCs

pid	Process
856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
2456	WerFault.exe
2456	WerFault.exe
2456	WerFault.exe
2456	WerFault.exe
2456	WerFault.exe
2456	WerFault.exe
2456	WerFault.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\yytx\install_1716826242.tmp	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
File created	C:\Program Files (x86)\yytx\youbo.exe	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\yytx\youbo.exe	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
File created	C:\Program Files (x86)\yytx\unist.exe	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\yytx\unist.exe	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2912	WerFault.exe	28

Kills process with taskkill 1 IoCs

evasion

pid	Process
580	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2680	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2912	youbo.exe
2912	youbo.exe
2912	youbo.exe
2912	youbo.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2912	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	28
PID 856 wrote to memory of 2912	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	28
PID 856 wrote to memory of 2912	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	28
PID 856 wrote to memory of 2912	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	28
PID 856 wrote to memory of 2724	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	30
PID 856 wrote to memory of 2724	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	30
PID 856 wrote to memory of 2724	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	30
PID 856 wrote to memory of 2724	856	79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2680	2724	cmd.exe	32
PID 2724 wrote to memory of 2680	2724	cmd.exe	32
PID 2724 wrote to memory of 2680	2724	cmd.exe	32
PID 2724 wrote to memory of 2680	2724	cmd.exe	32
PID 2912 wrote to memory of 2456	2912	youbo.exe	33
PID 2912 wrote to memory of 2456	2912	youbo.exe	33
PID 2912 wrote to memory of 2456	2912	youbo.exe	33
PID 2912 wrote to memory of 2456	2912	youbo.exe	33
PID 2724 wrote to memory of 580	2724	cmd.exe	34
PID 2724 wrote to memory of 580	2724	cmd.exe	34
PID 2724 wrote to memory of 580	2724	cmd.exe	34
PID 2724 wrote to memory of 580	2724	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\yytx\youbo.exe
  "C:\Program Files (x86)\yytx\youbo.exe" inst
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1016
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Tempa.bat
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 /n 5
    3⤵
    - Runs ping.exe
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM 79b2583a841d74473396b4fef58ae663_JaffaCakes118.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Tempa.bat

Filesize
303B

MD5
42575c646c3bfe2b5b61391b21a4d2ff

SHA1
8bf8ab09670487ca631ef51f4266353f454cc5dc

SHA256
d6a51a2a2d23093d110e4ed7546a5970319e9b562c755be4b448c4a16a31fdea

SHA512
500ba17ff466466ba50915d211e3bf054bb7aed8875d78dfb704746ca92a060e70969e1578fe7164367681af26b14bd876e828ee5f6ba0a9c25b44aab5098331

Download Submit
C:\Users\Admin\AppData\Local\yytx\config.ini

Filesize
76B

MD5
1f6901cc16331a5f0647829bcb8af199

SHA1
75989ced7e3ce5b22974cb569beaa5176ccdb8ad

SHA256
99e94cf28d6a7bb8803669788f4c132eb827c3dee3f2fe75c579e170c77e3ce2

SHA512
5cdaed341edff7cf610259e460bfaf867149f7cc740a6492beb2d9116d3a89499db858432fc7b4d2474522cf8b4e918ee8b91dc280b992b2c7c548e03f91f192

Download Submit
\Program Files (x86)\yytx\unist.exe

Filesize
298KB

MD5
c757a37058811d8b129d2e16c7027f2d

SHA1
819298918fae59743360497f4cbf1b483bd5923b

SHA256
06e0bd7b9c6448d2b4aee3128266fb19ecdfe2bd190a973805b813ec4e9f5b54

SHA512
e413eff73f87fb337bfb89c9b7565fe1a6a99ce17516b31f6f074d3239d0d8aa37065eefa92f2dffca61b827b9bc59e10b71f5fba1dc0f74efde294d4502984d

Download Submit
\Program Files (x86)\yytx\youbo.exe

Filesize
1.7MB

MD5
474e023d6e8b5fac9d69ade44e47969d

SHA1
c82b19b570a81b2e3356b81073755fddac568396

SHA256
c05adc01400b138768cc614d74d4e7bd60a49a371ea9256dfb0c61d9d6dba173

SHA512
666682572dbc9d608938091b7addebcb96edeaaec671539aa5a1276cdac28844e1c2fad12b8289baa8c7580914753595c2fd64afaf204296b0f9b9f69fcfbf9e

Download Submit

Analysis

Sharing