19d2dabd81cb429c8c6784522c7218a3d3b46ccdcb0b3faec70ff553b224c63a

General

Target

3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe
Size

51KB
MD5

3beaba18af17eae65fa47c725e738c5f
SHA1

716c996b257d2e26e4676bb1744a6ae05fd48533
SHA256

19d2dabd81cb429c8c6784522c7218a3d3b46ccdcb0b3faec70ff553b224c63a
SHA512

69a608b882688c5f682d764467b34d17c6e75c1f88658ac4453f2f2a73eae01df9b480d48cff64812f491c683781dcd83d6f918cfebe862828824a76285d51f9
SSDEEP

768:xSqtQli5NJsYFDXEc66O5WCITIcyn7fwdgW7W1llMTzVKGu:Htbsw6EJynr1+WflM1pu

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2396	rundll32.exe
2396	rundll32.exe
2416	rundll32.exe
2396	rundll32.exe
2396	rundll32.exe
2540	rundll32.exe
2396	rundll32.exe
2540	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-10-0x0000000000400000-0x0000000000622000-memory.dmp	upx
behavioral1/memory/2104-6-0x0000000000400000-0x0000000000622000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmlfd008.ocx	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\0F76ACC3ce.dll	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe
File created	C:\Program Files\Common Files\mml11011.ocx	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\mml11011.ocx	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe
File created	C:\Program Files\Common Files\0F76ACC3ce.dll	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2416	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2396	rundll32.exe
476	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2396	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2540	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	30
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2396	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32
PID 2104 wrote to memory of 2416	2104	3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\mmlfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  PID:2540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0F76ACC3ce.dll" m3
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\mml11011.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\3beaba18af17eae65fa47c725e738c5f_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\0F76ACC3ce.dll

Filesize
10KB

MD5
83bf84090cd41cb647b22e0c21e268df

SHA1
d3bf3a2684008150713a6775b80661a57a14bd84

SHA256
e2ddc61c1d5c52f968479ec0284e5d3f47011b2f1b7658cf7ef26673b21549e7

SHA512
c1dea1500809d8ab88b04c206ac1ab9c6c193b91613a8b87d9b88c74c80dfc1d60857cc6b0717ac5f30088d857f066132fb78499bf6de60047b9322e5ea9ea7a

Download Submit
\Program Files\Common Files\mml11011.ocx

Filesize
72KB

MD5
8b676df5672c9a0c80fd90ec162ed16a

SHA1
0dfbdb0e1835a16f68dc7675d6ff498576a32aae

SHA256
c8847f4aba875a143869099f9893e1dfc9a8ac519b489778afdc09cc264f4d55

SHA512
2054b668825db740f5c0a942d9f6021d5778440f42d28711a6a1bd1ae3ce1b21f4ec67f3dca223c6d2780d26ba184de36c0dc8c8d4eae332b711b655485d94d1

Download Submit
\Windows\SysWOW64\mmlfd008.ocx

Filesize
17KB

MD5
f45774c967deeebb10aea4e25227515b

SHA1
79d67ffa00dd3dd589210a2f4fe4f58153b51722

SHA256
057288c779ae91555b32359c73a969698077ef47e7dcf71f234bc7be6ab6f796

SHA512
a69846596734dbd9fe54291802b30fc28a195faeac2ad23f99d26614fbe4adec8c8c3b9e4376268454fc8aa92ef4c9fc1b99df8d6df7952f334919fdb86c8366

Download Submit
memory/2104-10-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2104-6-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2396-22-0x0000000010202000-0x0000000010203000-memory.dmp

Filesize
4KB

Download
memory/2396-17-0x0000000010000000-0x0000000010206000-memory.dmp

Filesize
2.0MB

Download
memory/2416-18-0x0000000010000000-0x0000000010217000-memory.dmp

Filesize
2.1MB

Download
memory/2540-21-0x0000000002150000-0x0000000002367000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing