0b75fd423188318136e07b624ca052914e249829d66f076644e5ee4c8c8f581c

General

Target

23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe
Size

6.8MB
MD5

23b09ec90a9bf4c19d86aca2710900a4
SHA1

992e2c92518408eec0dedb849124152f8ebfa882
SHA256

0b75fd423188318136e07b624ca052914e249829d66f076644e5ee4c8c8f581c
SHA512

e72b14e09fcce1bba914fb4ef6a7900b509c0d612ebee986840a28711dc95906884df1fe28e52c55a57345a65b708c5377ef4c35a622f15f33b51db2114b6d2f
SSDEEP

196608:U2ug7pXSSZGGKHsVzZbxJagR2+nUAYw1JEfG9gu5RwH:Qg7pl0HshZVJac2+pf1SfG9+H

Score

7^/10

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b000000012294-4.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2592	is-TAKNG.tmp

Loads dropped DLL 5 IoCs

pid	Process
2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe
2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe
2592	is-TAKNG.tmp
2592	is-TAKNG.tmp
2592	is-TAKNG.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	is-TAKNG.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2592	2080	23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\is-MRJ20.tmp\is-TAKNG.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MRJ20.tmp\is-TAKNG.tmp" /SL4 $C0154 C:\Users\Admin\AppData\Local\Temp\23b09ec90a9bf4c19d86aca2710900a4_JaffaCakes118.exe 6661220 50688
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cjl6114.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
\Users\Admin\AppData\Local\Temp\is-1CJ9P.tmp\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MRJ20.tmp\is-TAKNG.tmp

Filesize
864KB

MD5
b4e72755cd86f8815c154e2ce4cca5a9

SHA1
aba0bdacbb484a9efac2538425c201cc57b7e8b0

SHA256
19b5a0b29a7314d3da667ec1270046bb56360ef5581aa585965710eccf743d93

SHA512
f6d858a42af83df6799270eeb523fd56a40b53cd83b2a7d6fe7dbf449eb4d7198c75c3677f7edcd4761fc2bce93ac1068649b3ff1d6e9d3c299795dfc2c6192f

Download Submit
memory/2080-1-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2080-2-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2080-6-0x0000000000340000-0x00000000003B3000-memory.dmp

Filesize
460KB

Download
memory/2080-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-9-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/2080-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-25-0x0000000000340000-0x00000000003B3000-memory.dmp

Filesize
460KB

Download
memory/2080-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-30-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2080-29-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2080-28-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2592-18-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download
memory/2592-27-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download
memory/2592-26-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2592-54-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing