fbc2a7eaa478e48e456b2e214af14d9750111563b382f9fc90efce707344cfa3

General

Target

348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
Size

123KB
MD5

348fdf073b5de29b499d5940d5f0b247
SHA1

d4dcf3f2d87c78c39f907348aec7554ccd0b6422
SHA256

fbc2a7eaa478e48e456b2e214af14d9750111563b382f9fc90efce707344cfa3
SHA512

a27c3efa19d72973d9061ec3d8991a32d27edd3d4c565c809cd7d0c7d2c6660b3baf50b6ef52a3842e3aa3cbfaa63325fff97a47cad9da808340aaa8028ba02f
SSDEEP

3072:teSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLsJhP0fN:tVYrJrOSsRwcpshP0fN

Score

8^/10

upx

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023455-26.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	iaccess32.exe

Executes dropped EXE 1 IoCs

pid	Process
4560	iaccess32.exe

Loads dropped DLL 1 IoCs

pid	Process
4796	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2412-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-3.dat	upx
behavioral2/memory/4560-5-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/2412-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0007000000023455-26.dat	upx
behavioral2/memory/4796-28-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral2/memory/4560-58-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_3_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e.ico	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\Common\module.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_2_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_go_3.gif	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20110118190131\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\instant access.exe	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_logo_2.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110118190131\medias\p2e_1_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\iaccess32.exe	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\IESettingSync	iaccess32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iaccess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iaccess32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\À	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
2384	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
4560	iaccess32.exe
4560	iaccess32.exe
4560	iaccess32.exe
4560	iaccess32.exe
4560	iaccess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4560	2412	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	84
PID 2412 wrote to memory of 4560	2412	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	84
PID 2412 wrote to memory of 4560	2412	348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe	84
PID 4560 wrote to memory of 2384	4560	iaccess32.exe	87
PID 4560 wrote to memory of 2384	4560	iaccess32.exe	87
PID 4560 wrote to memory of 2384	4560	iaccess32.exe	87
PID 4560 wrote to memory of 4796	4560	iaccess32.exe	88
PID 4560 wrote to memory of 4796	4560	iaccess32.exe	88
PID 4560 wrote to memory of 4796	4560	iaccess32.exe	88

C:\Users\Admin\AppData\Local\Temp\348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\348fdf073b5de29b499d5940d5f0b247_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - Runs regedit.exe
    PID:2384
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:4796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk

Filesize
2KB

MD5
f9e6d9335e6be9fff046754d2c53525d

SHA1
d872d8c2bcd2649e540abbfa98975959245f927d

SHA256
a08dccb6c0c6511b49a5cfeaa7ca1b06787c0e97c26a4186913b20adfb5dea3b

SHA512
34f9b75c6277de37b4b61baa73f56cd3cfc39662657eecac40c4d97d25aecbce3e24915c08abdb04d0e657177bc8a3808b338b4bfade54d3fcf4d51217ece7f8

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110118190131\dialerexe.ini

Filesize
668B

MD5
b3ce2faa46f2957ae1013add8e06d953

SHA1
4786c67fc5a409446232751d57257910619550b0

SHA256
1d9f8bd1520e030d0fb8a21a88dc6826446bc96197f159d46a910a5dfb4dd94d

SHA512
f29f1e8a72440ad969c7cd4300016615d47289369a7d427350a81223b080da4cf80436c1ed1cc1bf2ba125acf6409f08f94044a5e42f5805baf2f8f46970e77a

Download Submit
C:\Windows\SysWOW64\egaccess4_1071.dll

Filesize
76KB

MD5
b83f652ffa76451ae438954f89c02f62

SHA1
b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

SHA256
f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

SHA512
965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

Download Submit
C:\Windows\iaccess32.exe

Filesize
123KB

MD5
90cdc90ea59103961399647954255c65

SHA1
5e7b65a7d3e69e49fe601e9f2c4c24cc1e50373f

SHA256
55a196caf5b8c45c230661dae1a44b81ea95fbab1a84168bb0148b50b876cb0b

SHA512
5474d0010823d749ee514583f021a5094fcb0a6c51c142c856bb5a4bcedce102c9897ceba0acf38c570161ce568ee09285bd0c52569d8a16d07d9391713d0cbc

Download Submit
C:\Windows\tmlpcert2007

Filesize
6KB

MD5
b103757bc3c714123b5efa26ff96a915

SHA1
991d6694c71736b59b9486339be44ae5e2b66fef

SHA256
eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

SHA512
d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

Download Submit
memory/2412-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2412-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4560-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4560-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4796-28-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing