aaa66a53bdd5358a676b31d0f24feb7f482633c609fb9bd2b2cb7f7f880a18e3

General

Target

468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe
Size

44KB
MD5

468b6710bbb12fae5ef631ecad67b868
SHA1

9bdfd96261f00db0416c15bf6158a0760e5de3cc
SHA256

aaa66a53bdd5358a676b31d0f24feb7f482633c609fb9bd2b2cb7f7f880a18e3
SHA512

9fffe4a8e4ffc4fba72187d09cef158d00854884a64a3f0862d591f9a192d2538b846929e99c2c159f90a8ac5fdc0240ec4706aeb9f9af799fb7cc3bf5c8af73
SSDEEP

768:2+l9EvYidrxRO/sFUuuZ45NFwQ5+0Hve2qa0DO3ESOrim:N0gYE/sWupO0HSa0DO3EJ9

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1548	rundll32.exe

Loads dropped DLL 7 IoCs

pid	Process
5088	rundll32.exe
1632	rundll32.exe
1548	rundll32.exe
5088	rundll32.exe
5088	rundll32.exe
1632	rundll32.exe
1632	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000400000-0x000000000061C000-memory.dmp	upx
behavioral2/memory/3004-14-0x0000000000400000-0x000000000061C000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd008.ocx	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\0E578C81ce.dll	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe
File created	C:\Program Files\Common Files\whh16010.ocx	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\whh16010.ocx	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe
File created	C:\Program Files\Common Files\0E578C81ce.dll	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe
1548	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1632	rundll32.exe
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1632	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 5088	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	83
PID 3004 wrote to memory of 5088	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	83
PID 3004 wrote to memory of 5088	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	83
PID 3004 wrote to memory of 1632	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	84
PID 3004 wrote to memory of 1632	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	84
PID 3004 wrote to memory of 1632	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	84
PID 3004 wrote to memory of 1548	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	85
PID 3004 wrote to memory of 1548	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	85
PID 3004 wrote to memory of 1548	3004	468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0E578C81ce.dll" m3
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh16010.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\468b6710bbb12fae5ef631ecad67b868_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\0E578C81ce.dll

Filesize
10KB

MD5
f1f49fb85ab029ad86c02ebecb892b12

SHA1
664a602f8e843218c1158571714cd0adee1da939

SHA256
f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13

SHA512
600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673

Download Submit
C:\Program Files\Common Files\whh16010.ocx

Filesize
53KB

MD5
5b75d713409aaa6cf92d8cd9568e900f

SHA1
8ff06b680212b3324c58e87d994683c29a93c4db

SHA256
ef0b5f712ace0ac62e699cab2ec668c4108be448635e0e27176061bb0c2b77dc

SHA512
f64d236a79ffde583a57558f63f39f4a6a38b2ee75105371e46be33c6f8f8aeb2b5d0b3eee52b68c45950e37fc135fbd7c910fc081bfebe44d8024235fd38e1b

Download Submit
C:\Windows\SysWOW64\whhfd008.ocx

Filesize
14KB

MD5
731659d09654891912ac223e20cd10ab

SHA1
13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071

SHA256
672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b

SHA512
e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116

Download Submit
memory/1548-23-0x0000000010000000-0x0000000010213000-memory.dmp

Filesize
2.1MB

Download
memory/1632-25-0x0000000002540000-0x0000000002753000-memory.dmp

Filesize
2.1MB

Download
memory/1632-22-0x0000000010000000-0x0000000010206000-memory.dmp

Filesize
2.0MB

Download
memory/1632-20-0x0000000002540000-0x0000000002753000-memory.dmp

Filesize
2.1MB

Download
memory/3004-0-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/3004-14-0x0000000000400000-0x000000000061C000-memory.dmp

Filesize
2.1MB

Download
memory/5088-24-0x00000000027B0000-0x00000000029C3000-memory.dmp

Filesize
2.1MB

Download
memory/5088-17-0x00000000027B0000-0x00000000029C3000-memory.dmp

Filesize
2.1MB

Download
memory/5088-21-0x0000000010000000-0x0000000010208000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing