aff278a75b403a2c251e9fc7969afad9c5aea67ea171c2ec5d6f8eb69ee07df6

General

Target

5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
Size

448KB
MD5

5f9bbb0be8270c87d659dd29a02e36f5
SHA1

7f501afa76566a693d719b15f459721436f19e0b
SHA256

aff278a75b403a2c251e9fc7969afad9c5aea67ea171c2ec5d6f8eb69ee07df6
SHA512

57fb9d80e631eb3907c18e3631928a0ffae86c308f8a773b7daacea3409c8d80b78d81a21019c89ace5ac2142052f77f435695d2ea1ac14d03502c7071e0d7e8
SSDEEP

12288:/Ivy1bhtazBuQasx4xe4qWea+U3laQTe8+wTN:AvzBuQas1VGofBu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2852	kjhfa.exe

Executes dropped EXE 2 IoCs

pid	Process
2472	kjhfa.exe
2852	kjhfa.exe

Loads dropped DLL 2 IoCs

pid	Process
1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1932-10-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-12-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-11-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-6-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-4-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-13-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-16-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-15-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-17-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/2852-46-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/2852-47-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/1932-50-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral1/memory/2852-52-0x0000000000400000-0x0000000000516000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\cftmon = "C:\\Users\\Admin\\AppData\\Roaming\\kjhfa.exe"	kjhfa.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2540 set thread context of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2472 set thread context of 2852	2472	kjhfa.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
2472	kjhfa.exe
2852	kjhfa.exe
2852	kjhfa.exe
2852	kjhfa.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1932	2540	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2472	1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2472	1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2472	1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2472	1932	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	31
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32
PID 2472 wrote to memory of 2852	2472	kjhfa.exe	32

C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Users\Admin\AppData\Roaming\kjhfa.exe
    "C:\Users\Admin\AppData\Roaming\kjhfa.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Users\Admin\AppData\Roaming\kjhfa.exe
      C:\Users\Admin\AppData\Roaming\kjhfa.exe
      4⤵
      Deletes itself
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\del.tmp

Filesize
86B

MD5
9d1050b0b4c10ad0f952bf7dea46beaf

SHA1
a4db5f43bb56218c6dc6beba93fa8c42e3259674

SHA256
499d66f5b1b739c459a82671a54594c57b1dd3defda6cab883ba9ee979ab5597

SHA512
1c088ea8202c947b15a8612aebf1b8230b65f9dbe8b528ccfced8132d205a282b36a71cd6d30b5fa91daef25783ec2154d9a2702a6344b2608df1010cd12dfd0

Download Submit
C:\Users\Admin\AppData\Roaming\~check.tmp

Filesize
8B

MD5
f8d641ad4d35c70eb7598a24702d468a

SHA1
f8aa00af59545911badc1aa89c66c8cb621b5179

SHA256
c191159be25f0618cdef4cb538cd90721c96c856096c06575414eeabeb457fe8

SHA512
1fb69838b12ff0a824a9424c384f6a2cb885c61ce1b0fa320eb81619211c415fc2880d128848c00eb6764eb1e80523e9d1a40f747c5547e72f5edc82daf4ebde

Download Submit
\Users\Admin\AppData\Roaming\kjhfa.exe

Filesize
448KB

MD5
5f9bbb0be8270c87d659dd29a02e36f5

SHA1
7f501afa76566a693d719b15f459721436f19e0b

SHA256
aff278a75b403a2c251e9fc7969afad9c5aea67ea171c2ec5d6f8eb69ee07df6

SHA512
57fb9d80e631eb3907c18e3631928a0ffae86c308f8a773b7daacea3409c8d80b78d81a21019c89ace5ac2142052f77f435695d2ea1ac14d03502c7071e0d7e8

Download Submit
memory/1932-16-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-17-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-6-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-4-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-13-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-2-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-15-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1932-11-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-50-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-10-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1932-12-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2852-47-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2852-46-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2852-52-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads