2f3d1f1035e91545ba272ec5e3e78382348bc52ed1bce1f8be8ed9fc93235e94

General

Target
a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
Size 258KB
Sample240613-dtpe4aselb
SHA256 2f3d1f1035e91545ba272ec5e3e78382348bc52ed1bce1f8be8ed9fc93235e94
MD5 a3a5d68f1f54d88dd048f048ac6ce206
SHA1 14685a5506f910142a13d11eadf4ff9909535ef8
SHA512 c911d184c78c97d7222850f80260935b7e8fe20f5a5855ba2f1fef5565beb0b7b7ebde911bd85267699260e5c6dfaf24137a77ee6fee33d4a83540b747e5b65e
SSDEEP 6144:MH4WH/bcRvjhdtigZbHFDEGZbjh2dOOVTJ6h4TfHFDE:FRvVdtiQNEIjhShrmsfNE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000233f4-35.dat	acprotect

Deletes itself 1 IoCs

pid	Process
4964	Sysgasg32.exe

Executes dropped EXE 1 IoCs

pid	Process
4964	Sysgasg32.exe

Loads dropped DLL 1 IoCs

pid	Process
4964	Sysgasg32.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "Sysgasg32.exe \"%1\" %*"	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000233f4-35.dat	upx
behavioral2/memory/4964-92-0x0000000010000000-0x000000001000C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LoadSystem = "Sysgasg32.exe powrprof.dll,LoadCurrentPwrScheme"	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsAgent = "C:\\Program Files (x86)\\Windows NT\\Windows.exe"	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\@AppHelpToast32.exe	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\@AppHelpToast32.exe	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gasga.cfg	Sysgasg32.exe
File opened for modification	C:\Windows\SysWOW64\gasga.cfg	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\syshook.dll	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\Windows.exe	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Windows.exe	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Dxgasg16.dll	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\Windows\gsagLib.sys	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\Windows\Faith.ini	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File created	C:\Windows\Sysgasg32.exe	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\Windows\Sysgasg32.exe	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
File opened for modification	C:\Windows\Dxgasg16.dll	Sysgasg32.exe
File opened for modification	C:\Windows\Faith.ini	Sysgasg32.exe
File opened for modification	C:\Windows\Sysgasg32.exe	Sysgasg32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "Sysgasg32.exe \"%1\" %*"	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	Sysgasg32.exe
4964	Sysgasg32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4964	3288	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe	81
PID 3288 wrote to memory of 4964	3288	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe	81
PID 3288 wrote to memory of 4964	3288	a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3a5d68f1f54d88dd048f048ac6ce206_JaffaCakes118.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\Sysgasg32.exe
  C:\Windows\Sysgasg32.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows.exe

Path C:\Program Files (x86)\Windows NT\Windows.exe
Size 174KB
SHA256 2ce8d28e7831b620711241bde870e8fd6630b2c62719d022dfcf0c2662390aa2
MD5 5c76e0e46bbe51369bbbef1f57e76a4b
SHA1 14ac156efe0ae9edf184df6d06e3382a07f094c9
SHA512 d5c3d63c865d5d67f2a1a927b285202d0bc8049269dfae9705411f1ebfad5c1fd6c7e5aa2f2d0829fa26202d765b32899a5acab037a207dc0c232aee278a720b
SSDEEP 3072:JuHBWWHo4Fpc7KwvkD6Bf9ntxAguL1W1U2xCjaQI51GqvZT7kDhWHFDEw:MH4WH/bcRvjhdtigZbHFDE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OAG5F56.tmp

Path C:\Users\Admin\AppData\Local\Temp\OAG5F56.tmp
Size 13KB
SHA256 abfa4b5456d9e9f55a57fb1fb5b3bdd15210a084aa0325a73d5b49b41a50eef7
MD5 1184a7318020bdd89657e48ee038aefb
SHA1 a423a691987a2f37ac2a31cbda16c4b70fa678b1
SHA512 57f939150929b7f2c074bd8e588e7b0a0a59e6a66f3fb1528d27890d9b7538bb3231a03cd7a47fe818810d9c40d92c1cc6dfa40359eecfa3df0a0adfa66a71b7
SSDEEP 192:HT+LyPFQn3gIMqaR/0qyWpW8t7vZfe2KOoiT9goUZCTqZEWeaM8r5RKn:yMOtM/M9WpWWRf17oQ9goUZCTsE6RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dxgasg16.dll

Path C:\Windows\Dxgasg16.dll
Size 236B
SHA256 e62e785ec2a0851b895d6474a49ab6a4c9b995a8778382256bdc1a45ced27200
MD5 117ab492f1ce9308a7b255a926c1f26a
SHA1 5c6dcc23850d3fe15d4b02de9688d9097a1f6106
SHA512 69a0f7487bb5764ec2974f5347e27bdc0f44bade21929c9a3100e350737e9e09aa90266a61c2ab7c2133cf8aa958f7823e5b2455009df17f1f76e417bcd67056
MD5 SHA1 SHA512

Submit Download

Dxgasg16.dll

Path C:\Windows\Dxgasg16.dll
Size 143B
SHA256 3dd7d4fa39dc09f73cb2bcd1d4e4667862410d7b4a38a9ef3f514dbad07ae60e
MD5 997d2931650aa7b90f643207d2c89a96
SHA1 3135ca7b46cea41731852436cef4e2af5a0a6fdf
SHA512 731d58c3ede204120d3e9f35f8f0b3fab0a66df6248d21a2b385a51c52bfa72f840f45d16473101a2a0953905c46e37cc08c8b3ed2c6c0eed2e17b4fe08536b3
MD5 SHA1 SHA512

Submit Download

Faith.ini

Path C:\Windows\Faith.ini
Size 59B
SHA256 6318c58b0d4bed2c77fda92fa53e5df100bbbed50668fdc84c4b3b0e29abc205
MD5 16c91e23d2bc1afbb6b0eba21338ce43
SHA1 f5de8fb228fa8ee2e8668f278a96e58ef716a410
SHA512 5345d4c3e7dfa5f484cadb90b0b344811d5110584fa7e1f39bb761b2ee659a1259d5057e10f76cb4dddc75026e648a0fc15c4b65d1ddd01681148415e7b49977
MD5 SHA1 SHA512

Submit Download

gasga.cfg

Path C:\Windows\SysWOW64\gasga.cfg
Size 326B
SHA256 f916f06612987b44cdf217f0cdcf02af211e731e91f8bce1508ebd8c3be79c7c
MD5 6cce7fd97bb8dbfc3feaaef5459db4dc
SHA1 b637366a18502f9f13d78de41f53e7094f8e49a4
SHA512 ba9019d5a9c6aee04f2b46d6efb79ea10e5b4e704dfd55c4b9cd677e48812184ca7a14229ff89e01a16944d3398d8e896d7d1a0540aa8c52bfcc3731465c5d91
MD5 SHA1 SHA512

Submit Download

memory/4964-92-0x0000000010000000-0x000000001000C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads