3127ee1688471ea127309ada230fb2e7d602ce539103f700e8964e29ec63222c

General

Target

0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe
Size

356KB
MD5

0f0abd547d5ac8124bc0bdf58065d853
SHA1

6c0fb3973741d10862f0ce5a26f401aa706f6a3b
SHA256

3127ee1688471ea127309ada230fb2e7d602ce539103f700e8964e29ec63222c
SHA512

bc676bdea24dab00aeb48b8ff04814393b950dd8e6eb3f03942ae6b4a687625e36e3916bc69676a1d79c8999c0d03d2c809319d91f0411d42143336f6b759298
SSDEEP

6144:dKrxiyLvmWVXGleQv39p2pTA4g5rdepaZ66vDQM0h5viN3VYgX:stLXh76CTAkagYDQMU5o7

Score

10^/10

evasion execution spyware stealer

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ivhg32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Debug\ivhg32.exe = "C:\\Windows\\Debug\\ivhg32.exe:*:Enabled:KL"	ivhg32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ivhg32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Debug\ivhg32.exe = "C:\\Windows\\Debug\\ivhg32.exe:*:Enabled:KL"	ivhg32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	2update32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	2update32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	2update32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\2update32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\2update32.exe:*:Enabled:KL"	2update32.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	2update32.exe

Executes dropped EXE 4 IoCs

pid	Process
2092	1unpacker.exe
1252	2update32.exe
1960	ivhg32.exe
1376	ivhg32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\result.dark	2update32.exe
File created	C:\Windows\Debug\bc	ivhg32.exe
File opened for modification	C:\Windows\Debug\bc	2update32.exe
File created	C:\Windows\Debug\ivhg32.exe	2update32.exe
File created	C:\Windows\Debug\result.dark	2update32.exe
File created	C:\Windows\Debug\bc	ivhg32.exe
File opened for modification	C:\Windows\Debug\bc	ivhg32.exe
File created	C:\Windows\Debug\bc	2update32.exe
File opened for modification	C:\Windows\Debug\ivhg32.exe	2update32.exe
File opened for modification	C:\Windows\Debug\bc	ivhg32.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
548	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3996	taskkill.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ivhg32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ivhg32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ivhg32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ivhg32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ivhg32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2update32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe
1252	2update32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 2092	684	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe	83
PID 684 wrote to memory of 2092	684	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe	83
PID 684 wrote to memory of 2092	684	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe	83
PID 2092 wrote to memory of 3996	2092	1unpacker.exe	85
PID 2092 wrote to memory of 3996	2092	1unpacker.exe	85
PID 2092 wrote to memory of 3996	2092	1unpacker.exe	85
PID 684 wrote to memory of 1252	684	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe	92
PID 684 wrote to memory of 1252	684	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe	92
PID 684 wrote to memory of 1252	684	0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe	92
PID 1252 wrote to memory of 548	1252	2update32.exe	93
PID 1252 wrote to memory of 548	1252	2update32.exe	93
PID 1252 wrote to memory of 548	1252	2update32.exe	93
PID 1252 wrote to memory of 1960	1252	2update32.exe	96
PID 1252 wrote to memory of 1960	1252	2update32.exe	96
PID 1252 wrote to memory of 1960	1252	2update32.exe	96

C:\Users\Admin\AppData\Local\Temp\0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f0abd547d5ac8124bc0bdf58065d853_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Roaming\1unpacker.exe
  "C:\Users\Admin\AppData\Roaming\1unpacker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Users\Admin\AppData\Roaming\2update32.exe
  "C:\Users\Admin\AppData\Roaming\2update32.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\sc.exe
    sc delete 584483
    3⤵
    - Launches sc.exe
    PID:548
- - C:\Windows\Debug\ivhg32.exe
    "C:\Windows\Debug\ivhg32.exe" /start
    3⤵
    - Modifies firewall policy service
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1960

C:\Windows\Debug\ivhg32.exe
C:\Windows\Debug\ivhg32.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1unpacker.exe

Filesize
356KB

MD5
cf212a37c75b3c175cb682ec6ee21c9b

SHA1
51b0526383c80c36a187c484fc3fdfddd214ce31

SHA256
64c7057b774e062a0cfc5c816a00cb57f2a39f988985aebfc69b089f29e11eec

SHA512
eec8acde38a08ef941371677362dbb876b9f8583393ed877d2be4a909fb919db7b2726730660f98d34e6ce75573cee91ad56a1d091d54351cba9c37cf7b89417

Download Submit
C:\Users\Admin\AppData\Roaming\2update32.exe

Filesize
95KB

MD5
9c87f45a17ffe37ecd671671b26e8469

SHA1
598b33805853468cc2919e99ac66e8bcff205837

SHA256
1c885b737c735db2aba82127f9f2efcf281aa8b7b385543b18a8ef36d5cd685d

SHA512
ccb4209ed36ca985721ec1909e9b5a8af2f62bafccf732ab43af2f8208a6521af5b6614f46cebace37fac16fe3b02b2aa7c83d76b7f808260397c9e5af237320

Download Submit
memory/684-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1252-68-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1376-76-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1960-75-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2092-20-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/2092-21-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads