fbc2a7eaa478e48e456b2e214af14d9750111563b382f9fc90efce707344cfa3

General

Target

348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
Size

123KB
MD5

348fdf073b5de29b499d5940d5f0b247
SHA1

d4dcf3f2d87c78c39f907348aec7554ccd0b6422
SHA256

fbc2a7eaa478e48e456b2e214af14d9750111563b382f9fc90efce707344cfa3
SHA512

a27c3efa19d72973d9061ec3d8991a32d27edd3d4c565c809cd7d0c7d2c6660b3baf50b6ef52a3842e3aa3cbfaa63325fff97a47cad9da808340aaa8028ba02f
SSDEEP

3072:teSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLsJhP0fN:tVYrJrOSsRwcpshP0fN

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo jimddp = "electronic-group"	iaccess32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000600000001752e-30.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3064	iaccess32.exe

Loads dropped DLL 3 IoCs

pid	Process
2784	regsvr32.exe
3064	iaccess32.exe
3064	iaccess32.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x0008000000012118-8.dat	upx
behavioral1/memory/2520-7-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-9-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000600000001752e-30.dat	upx
behavioral1/memory/2784-32-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral1/memory/3064-78-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-79-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-80-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-82-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-83-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-84-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-86-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-87-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-88-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-89-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-90-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-91-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-92-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-93-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3064-94-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\Common\module.php	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20110118190131\dialerexe.ini	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_2_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_3_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\instant access.exe	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_1_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_logo_2.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_go_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e.ico	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe
File created	C:\Windows\iaccess32.exe	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
2540	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
3064	iaccess32.exe
3064	iaccess32.exe
3064	iaccess32.exe
3064	iaccess32.exe
3064	iaccess32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3064	2520	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	30
PID 2520 wrote to memory of 3064	2520	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	30
PID 2520 wrote to memory of 3064	2520	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	30
PID 2520 wrote to memory of 3064	2520	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	30
PID 3064 wrote to memory of 2540	3064	iaccess32.exe	31
PID 3064 wrote to memory of 2540	3064	iaccess32.exe	31
PID 3064 wrote to memory of 2540	3064	iaccess32.exe	31
PID 3064 wrote to memory of 2540	3064	iaccess32.exe	31
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32
PID 3064 wrote to memory of 2784	3064	iaccess32.exe	32

C:\Users\Admin\AppData\Local\Temp\348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - Runs regedit.exe
    PID:2540
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Instant Access\Multi\20110118190131\dialerexe.ini

Filesize
668B

MD5
b3ce2faa46f2957ae1013add8e06d953

SHA1
4786c67fc5a409446232751d57257910619550b0

SHA256
1d9f8bd1520e030d0fb8a21a88dc6826446bc96197f159d46a910a5dfb4dd94d

SHA512
f29f1e8a72440ad969c7cd4300016615d47289369a7d427350a81223b080da4cf80436c1ed1cc1bf2ba125acf6409f08f94044a5e42f5805baf2f8f46970e77a

Download Submit
C:\Users\Public\Desktop\NOCREDITCARD.lnk

Filesize
2KB

MD5
8fc291c56ce9bd7c35979d26c5610350

SHA1
0be7bc0239996b44415f4df368d279019a8beed5

SHA256
c7332bab66deae4fbb15f53de5e89513f8136f59fdc4bbe22a641e2a4949f6ee

SHA512
2b1459f9e947bde02ca93654eb90fd97c38441068d05af84aa39c7e28dda680dfb84fccc0c5634cdd10714297f0935ed042999627b7930d88c1ab281541c0427

Download Submit
C:\Windows\SysWOW64\egaccess4_1071.dll

Filesize
76KB

MD5
b83f652ffa76451ae438954f89c02f62

SHA1
b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

SHA256
f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

SHA512
965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

Download Submit
C:\Windows\iaccess32.exe

Filesize
123KB

MD5
90cdc90ea59103961399647954255c65

SHA1
5e7b65a7d3e69e49fe601e9f2c4c24cc1e50373f

SHA256
55a196caf5b8c45c230661dae1a44b81ea95fbab1a84168bb0148b50b876cb0b

SHA512
5474d0010823d749ee514583f021a5094fcb0a6c51c142c856bb5a4bcedce102c9897ceba0acf38c570161ce568ee09285bd0c52569d8a16d07d9391713d0cbc

Download Submit
C:\Windows\tmlpcert2007

Filesize
6KB

MD5
b103757bc3c714123b5efa26ff96a915

SHA1
991d6694c71736b59b9486339be44ae5e2b66fef

SHA256
eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

SHA512
d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

Download Submit
memory/2520-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2520-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2784-32-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/3064-79-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-84-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-57-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/3064-78-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-80-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-81-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/3064-82-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-83-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-45-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/3064-86-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-87-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-88-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-89-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-90-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-91-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-92-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-93-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3064-94-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing