456ae5488275a3563a2af26d3c1ea309d1a54b31a5f38bf6a700eb627dbe331a

General

Target

a9a5b4f78a4263e0516a51f900ea959a_JaffaCakes118.exe
Size

257KB
MD5

a9a5b4f78a4263e0516a51f900ea959a
SHA1

ff8b2104aac757c899b0a2eb3e3a52b200f88bc7
SHA256

456ae5488275a3563a2af26d3c1ea309d1a54b31a5f38bf6a700eb627dbe331a
SHA512

7dee1b515ed0ab872e8afc01ba6021c45d99681a28993cbb15b9ab19ee5f1e7d0874d9e75ef4338b7195cca58ccab154591d4e956d9a6fe27057c0eec9805948
SSDEEP

6144:2IJP4jadW8oBS2H8jJeOmH5AXtywLBVfYAsgdIzAudJ:LP4j+jos2HCJeOmZSflNYARwdJ

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	a9a5b4f78a4263e0516a51f900ea959a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2276	ins1352.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1272-0-0x0000000000380000-0x00000000003FD000-memory.dmp	upx
behavioral2/memory/1272-31-0x0000000000380000-0x00000000003FD000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	ins1352.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ins1352.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	ins1352.exe
File created	C:\Windows\assembly\Desktop.ini	ins1352.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ins1352.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	3732	dw20.exe
Token: SeBackupPrivilege	3732	dw20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2276	ins1352.exe
2276	ins1352.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2276	1272	a9a5b4f78a4263e0516a51f900ea959a_JaffaCakes118.exe	82
PID 1272 wrote to memory of 2276	1272	a9a5b4f78a4263e0516a51f900ea959a_JaffaCakes118.exe	82
PID 2276 wrote to memory of 3732	2276	ins1352.exe	87
PID 2276 wrote to memory of 3732	2276	ins1352.exe	87

C:\Users\Admin\AppData\Local\Temp\a9a5b4f78a4263e0516a51f900ea959a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9a5b4f78a4263e0516a51f900ea959a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\n1352\ins1352.exe
  "C:\Users\Admin\AppData\Local\Temp\n1352\ins1352.exe" ins.exe /t102d555f8f949fc733d37b9a326cc6 /e11908441 /uaa9bf87b-4dd3-11e3-8a32-80c16e6f498c
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 1244
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n1352\ins1352.exe

Filesize
201KB

MD5
41752a764ab0dd80bcd2706d114bce70

SHA1
cd06116cce1dddb8a1558751b128b161246a1111

SHA256
0622cdc03025ccdf175efc6632d8a65f85fc034c65118527747f77370b508a73

SHA512
c2f63a5eda5d5f4618bad139e24fa4f5b8a3abf5e83263aac38e190c167ffeec284e9ec1448a9c359c8ddfcf9b83c2eab78f48d64ea0a3452d1cddeed71aaf08

Download Submit
memory/1272-0-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/1272-31-0x0000000000380000-0x00000000003FD000-memory.dmp

Filesize
500KB

Download
memory/2276-18-0x00007FFA2B2B0000-0x00007FFA2BC51000-memory.dmp

Filesize
9.6MB

Download
memory/2276-14-0x00007FFA2B2B0000-0x00007FFA2BC51000-memory.dmp

Filesize
9.6MB

Download
memory/2276-17-0x000000001BB80000-0x000000001C04E000-memory.dmp

Filesize
4.8MB

Download
memory/2276-13-0x000000001B3B0000-0x000000001B3BA000-memory.dmp

Filesize
40KB

Download
memory/2276-19-0x000000001C0F0000-0x000000001C18C000-memory.dmp

Filesize
624KB

Download
memory/2276-20-0x000000001B470000-0x000000001B478000-memory.dmp

Filesize
32KB

Download
memory/2276-21-0x00007FFA2B2B0000-0x00007FFA2BC51000-memory.dmp

Filesize
9.6MB

Download
memory/2276-22-0x00007FFA2B2B0000-0x00007FFA2BC51000-memory.dmp

Filesize
9.6MB

Download
memory/2276-23-0x00007FFA2B2B0000-0x00007FFA2BC51000-memory.dmp

Filesize
9.6MB

Download
memory/2276-30-0x00007FFA2B2B0000-0x00007FFA2BC51000-memory.dmp

Filesize
9.6MB

Download
memory/2276-12-0x00007FFA2B565000-0x00007FFA2B566000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads