5d5ed938a3f2c8cf547f5a14fc2523f88d0aacb6101a9d0375c9523761698d87

General

Target

3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
Size

381KB
MD5

3f5886747e41575d3b459d9637a9b812
SHA1

cce034dcd6f632bda6214a5872ff1be5bcea10c2
SHA256

5d5ed938a3f2c8cf547f5a14fc2523f88d0aacb6101a9d0375c9523761698d87
SHA512

22b7ff028a62b20cbbe5fd46030ad041fe2f7cc84b72ff9a8816bc4ede285915c77144b6c8598c825a725cf30254dd17533d583e297fca86265da335859ca948
SSDEEP

6144:qFJ0Q3CVSCr7p0XFaE8V3u8TYg58E+su8Uu1oyb7kEOgpVXGeCz6z:K3z8KFadV3FMguE+PooY7kqOeCz6z

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000234b6-29.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3184	SmartTipC.exe

Loads dropped DLL 9 IoCs

pid	Process
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234b6-29.dat	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\smarttip\SmartTipC.exe	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
File created	C:\Program Files (x86)\smarttip\Uninstall.exe	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3184	SmartTipC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3716	4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe	86
PID 4412 wrote to memory of 3716	4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe	86
PID 4412 wrote to memory of 3716	4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe	86
PID 4412 wrote to memory of 3184	4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe	88
PID 4412 wrote to memory of 3184	4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe	88
PID 4412 wrote to memory of 3184	4412	3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f5886747e41575d3b459d9637a9b812_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn STSTART /tr "\"C:\Program Files (x86)\smarttip\SmartTipC.exe\" \"/RUN\"" /sc onlogon /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3716
- C:\Program Files (x86)\smarttip\SmartTipC.exe
  "C:\Program Files (x86)\smarttip\SmartTipC.exe" UPDATE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\smarttip\SmartTipC.exe

Filesize
718KB

MD5
deb65fd1d5fa1828c005f6a4adf91d4c

SHA1
7fd244f1e024552ab68e7d4e83750b99a0fe6a02

SHA256
9a5e776bb42f63bc8e14c82d0275a3439f940eb98ea62348b50576f65c3b38ac

SHA512
dc29bc568a469aeab28c2842f5b9ba8141b92478eb414e843168fdfc90535bb6bafdac8a58728dbe94206b0bf16fdc6ec4bde79f3f35d28d033193876a5dd339

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\KillProcDLL.dll

Filesize
44KB

MD5
3599d30554ad65dc29fc689217d2152e

SHA1
8f5fcc313b667a1de2d56573bcf98d43fd0d4ff9

SHA256
1af3ac7d3176af42e8594ba0c33821d3318f4eea5cbb799bf8fab58e480efe0e

SHA512
846776b1d908b5204667715ffdfd3a6c76dface1677e8b1e5156ceac2ef0a739f68b48ccbb919c9e08d6ff359a93174bf0b90def7d48cee54cd3c41d8d8575f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\nsExec.dll

Filesize
6KB

MD5
e54eb27fb5048964e8d1ec7a1f72334b

SHA1
2b76d7aedafd724de96532b00fbc6c7c370e4609

SHA256
ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

SHA512
c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC3DD.tmp\version.dll

Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
memory/4412-11-0x0000000002400000-0x000000000240C000-memory.dmp

Filesize
48KB

Download
memory/4412-32-0x0000000002400000-0x000000000240C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads