2f57ec881ec13c5293400b0b933f6ff8ec15122d9963ff6e70f8959428c02757

General

Target

39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe
Size

1.3MB
MD5

39f9d17395a7112b6e5a2ea8377a1a66
SHA1

363bdb2a80f56700446d8f4cefc116eb11544162
SHA256

2f57ec881ec13c5293400b0b933f6ff8ec15122d9963ff6e70f8959428c02757
SHA512

9f2c4c3f848d869a5e9a8743b9ede3e34cb5c2747f2fa95824147ccd4badb27ef9d4aa62373fe8a841d43355f451c90f018d974d78259b23960ca9724befa296
SSDEEP

24576:vA3m4NWNwH6U+X+7WX/baOwkuSCwhm2v+K8zyHyhX8DLRVvEYg7:Y3o+6x+7sDwDSLm2GxGw6/vEYg7

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	wg.exe

Executes dropped EXE 3 IoCs

pid	Process
4356	wg.exe
2052	CsOnline.exe
4028	110.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000234dc-15.dat	upx
behavioral2/memory/2052-16-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2052-47-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4592	2052	WerFault.exe	86
4328	4028	WerFault.exe	91

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4028	110.exe
4028	110.exe
4028	110.exe
4028	110.exe
4028	110.exe
4028	110.exe
4028	110.exe
4028	110.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	CsOnline.exe
Token: SeIncBasePriorityPrivilege	4028	110.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4028	110.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe
3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe
4356	wg.exe
4356	wg.exe
4356	wg.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4356	3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe	83
PID 3216 wrote to memory of 4356	3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe	83
PID 3216 wrote to memory of 4356	3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe	83
PID 3216 wrote to memory of 2052	3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe	86
PID 3216 wrote to memory of 2052	3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe	86
PID 3216 wrote to memory of 2052	3216	39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe	86
PID 4356 wrote to memory of 4028	4356	wg.exe	91
PID 4356 wrote to memory of 4028	4356	wg.exe	91
PID 4356 wrote to memory of 4028	4356	wg.exe	91

C:\Users\Admin\AppData\Local\Temp\39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39f9d17395a7112b6e5a2ea8377a1a66_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216
- C:\wg.exe
  C:\wg.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\110.exe
    "C:\110.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 352
      4⤵
      Program crash
      PID:4328
- C:\CsOnline.exe
  C:\CsOnline.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 304
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2052 -ip 2052
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4028 -ip 4028
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\110.exe

Filesize
60KB

MD5
19b79f598a8eb08b84a6f716a5983b25

SHA1
e39ed35f8cfe6a11e75ffa539f05a861a951c7e5

SHA256
565899fb4cb5b269233e8ec756f8fbfb64fe5ee86341fd51e6dd4004b4d097b0

SHA512
4fc5f4c7d5c80b09fb2ccbab955ca6fe0c9353053cf54329b5e4017cb32c8316baf665947f21b2a4e6cb9e2c0963b9005b5381a0b509ffe96e2a8da0513a0942

Download Submit
C:\CsOnline.exe

Filesize
18KB

MD5
570c00caff64cdb29fb0f8fc19edd904

SHA1
3547c1062f82f5a131af74f211e942f8aa6248fb

SHA256
1b6470cd66688a5fc4884fd148046612492805c30dd1c019cafcce93a3601a4c

SHA512
2f25213c7ddc934373ac26504ed8cf5b595088085f85286367e11751a4d95d26455bfb8bf995997ca352d93ef2f9924cf15fc4b56f83cd4987fa6edea25c7aab

Download Submit
C:\wg.exe

Filesize
746KB

MD5
5ce28b75a227da5812a9279a2f6351ae

SHA1
cf72c47f42ca1c2149e035e8a978abedef7d1bd2

SHA256
9f00455b33b6813e0d88b15d2da0e932ec90a1d1429a29c90f62e38a72caebe6

SHA512
1ee1f4f8d4e2dafcb87114461625a5a688627453b9b32971c45e3514d09a8d78f0dc3b870c03be36b0584b4fdc47822845231e14a2fde39f69f5cc43d455f459

Download Submit
memory/2052-16-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2052-47-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4028-48-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4356-6-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4356-5-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/4356-7-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/4356-8-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/4356-49-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/4356-50-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing