3b176c24fe8a662f681d40f938a21da97d3c03927afe02718a0dcb84267783ca

General

Target

03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe
Size

3.4MB
MD5

03445871c795830b8ee9ae9dcf390b99
SHA1

83b4d896335f188a3df8bf5261b18159ff50c855
SHA256

3b176c24fe8a662f681d40f938a21da97d3c03927afe02718a0dcb84267783ca
SHA512

36ea317d6a629df79a9fa146789d6a393f43ecbd545f7a736abd8b1258ea2a576df9dff52bfd558ab3ca866507a91c5aba0658a4d25fa1e073988bea4896ce85
SSDEEP

49152:M2dmukqM7wtsRIPeJWEtfcqZzql1H6OelZMJcM3CvKmUV69fHcKs7ned89FTA9S:hcBquRIPK1JqAlZMqvKmUoc7n089F0s

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
3232	Services.exe
1292	setup-4.5.0.exe
2828	is-5R8B2.tmp

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000233f1-11.dat	upx
behavioral2/memory/3232-17-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3232-40-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Windows\\Temp\\Services.exe"	Services.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3232	4744	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe	81
PID 4744 wrote to memory of 3232	4744	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe	81
PID 4744 wrote to memory of 3232	4744	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe	81
PID 4744 wrote to memory of 1292	4744	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe	82
PID 4744 wrote to memory of 1292	4744	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe	82
PID 4744 wrote to memory of 1292	4744	03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe	82
PID 1292 wrote to memory of 2828	1292	setup-4.5.0.exe	83
PID 1292 wrote to memory of 2828	1292	setup-4.5.0.exe	83
PID 1292 wrote to memory of 2828	1292	setup-4.5.0.exe	83

C:\Users\Admin\AppData\Local\Temp\03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03445871c795830b8ee9ae9dcf390b99_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\Temp\Services.exe
  "C:\Windows\Temp\Services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3232
- C:\Windows\Temp\setup-4.5.0.exe
  "C:\Windows\Temp\setup-4.5.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\is-7IUE9.tmp\is-5R8B2.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-7IUE9.tmp\is-5R8B2.tmp" /SL4 $701F0 "C:\Windows\Temp\setup-4.5.0.exe" 3176949 52736
    3⤵
    - Executes dropped EXE
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7IUE9.tmp\is-5R8B2.tmp

Filesize
657KB

MD5
3dafb498bb15d5260cb2c12b391a0d48

SHA1
c775ae9fdf18ab0ce38a8adffabe378f461e79a1

SHA256
c5d5f5f814c5bc4989d691442051e5e78cf1971eb9b773a7a26b438e58a73d7a

SHA512
a42f39a73bd4615490c6e33c017fa09f9992e3327d244b050b6634ad696d421170fd63ec5d5e66e92d112dc804eabd0bcd56494c9499d78fad8b46fe2ef32a31

Download Submit
C:\Windows\Temp\Services.exe

Filesize
13KB

MD5
9009cc0e1e28284df6fd01355eaab5d9

SHA1
cf3e4b84d70805200291d998a5a487088b008644

SHA256
19958b97027f6525c75fdd21f1f27eb6f97079940698337d86d0f838ddd3cbd4

SHA512
893a94ed538326f529e5927dccb75c0ff11b43aa500514ac45d431ee91e588ba9a5ca3dd7e56fea4d048c2654e5ae734537be8ee4a0e56344d7e409f8bd490f3

Download Submit
C:\Windows\Temp\setup-4.5.0.exe

Filesize
3.3MB

MD5
60dff601d8462606e1dcaaf80d4cce17

SHA1
7abac5efea234ee1a626bc458ba2d6b7e459ba83

SHA256
81c5db1b97296a73252ba39a87129b4d8e8332c51286bb783639f18e11e1a86d

SHA512
eb4461e64dec8ab0ece7db33fd23a7de8f22ac3659f46710d505748b4306d2892018b4ed9f22bbe8daa1c23d3de3fbec4d0d7e4bb8edb2c02070f055a83c108f

Download Submit
memory/1292-29-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1292-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1292-41-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2828-34-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2828-42-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3232-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3232-40-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4744-24-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads