5b8f86046bc88c7a2ddf8307873364dc6e781c0b926a3c4124e62f0b0d82c87a

General

Target

4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
Size

681KB
MD5

4af99412e169f9267b8a9233abba5a73
SHA1

a9cb06d3db5e2f38277a0f1605aaa71518e38a69
SHA256

5b8f86046bc88c7a2ddf8307873364dc6e781c0b926a3c4124e62f0b0d82c87a
SHA512

c63cac97be2832000779c5e03aad1ba87794ef3974811c6abb45b72c5fbc6374e72433ceffd684ac5be4d904a0798844febb8231d40250e5377c3b7f9ad3db1f
SSDEEP

12288:kPWGlHW6yRy5WxOr9YcjhFN9FM04UD8YxnpzsQXg1kHUldkJRR/+Uhav:kPr5yRW9fF1lLsQwmHUlir+Uh6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	SiZhu.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	SiZhu.exe

Loads dropped DLL 2 IoCs

pid	Process
1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1296-0-0x0000000000400000-0x0000000000586000-memory.dmp	themida
behavioral1/memory/1296-2-0x0000000000400000-0x0000000000586000-memory.dmp	themida
behavioral1/memory/1296-3-0x0000000000400000-0x0000000000586000-memory.dmp	themida
behavioral1/memory/1296-4-0x0000000000400000-0x0000000000586000-memory.dmp	themida
behavioral1/files/0x000700000001211b-13.dat	themida
behavioral1/memory/2844-16-0x0000000000400000-0x0000000000586000-memory.dmp	themida
behavioral1/memory/1296-14-0x0000000000400000-0x0000000000586000-memory.dmp	themida
behavioral1/memory/2844-20-0x0000000000400000-0x0000000000586000-memory.dmp	themida

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
File opened (read-only)	\??\H:	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SiZhu.exe	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SiZhu.exe	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SiZhu.exe	SiZhu.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
2844	SiZhu.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
2844	SiZhu.exe
2844	SiZhu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2844	1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe	31
PID 1296 wrote to memory of 2844	1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe	31
PID 1296 wrote to memory of 2844	1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe	31
PID 1296 wrote to memory of 2844	1296	4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4af99412e169f9267b8a9233abba5a73_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\SiZhu.exe
  C:\Windows\system32\SiZhu.exe SiZhu
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SiZhu.exe

Filesize
681KB

MD5
4af99412e169f9267b8a9233abba5a73

SHA1
a9cb06d3db5e2f38277a0f1605aaa71518e38a69

SHA256
5b8f86046bc88c7a2ddf8307873364dc6e781c0b926a3c4124e62f0b0d82c87a

SHA512
c63cac97be2832000779c5e03aad1ba87794ef3974811c6abb45b72c5fbc6374e72433ceffd684ac5be4d904a0798844febb8231d40250e5377c3b7f9ad3db1f

Download Submit
memory/1296-0-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1296-1-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/1296-2-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1296-3-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1296-4-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/1296-15-0x0000000004F10000-0x0000000005096000-memory.dmp

Filesize
1.5MB

Download
memory/1296-14-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2844-16-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2844-21-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/2844-20-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads