aff278a75b403a2c251e9fc7969afad9c5aea67ea171c2ec5d6f8eb69ee07df6

General

Target

5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
Size

448KB
MD5

5f9bbb0be8270c87d659dd29a02e36f5
SHA1

7f501afa76566a693d719b15f459721436f19e0b
SHA256

aff278a75b403a2c251e9fc7969afad9c5aea67ea171c2ec5d6f8eb69ee07df6
SHA512

57fb9d80e631eb3907c18e3631928a0ffae86c308f8a773b7daacea3409c8d80b78d81a21019c89ace5ac2142052f77f435695d2ea1ac14d03502c7071e0d7e8
SSDEEP

12288:/Ivy1bhtazBuQasx4xe4qWea+U3laQTe8+wTN:AvzBuQas1VGofBu

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3180	ahdgu.exe

Executes dropped EXE 2 IoCs

pid	Process
3564	ahdgu.exe
3180	ahdgu.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4812-2-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/4812-3-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/4812-4-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/4812-5-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/4812-6-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/4812-7-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/3180-28-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/3180-29-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/3180-30-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/4812-33-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/3180-35-0x0000000000400000-0x0000000000516000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cftmon = "C:\\Users\\Admin\\AppData\\Roaming\\ahdgu.exe"	ahdgu.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 3564 set thread context of 3180	3564	ahdgu.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
4812	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
4812	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
4812	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
3564	ahdgu.exe
3180	ahdgu.exe
3180	ahdgu.exe
3180	ahdgu.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4696 wrote to memory of 4812	4696	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	87
PID 4812 wrote to memory of 3564	4812	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	88
PID 4812 wrote to memory of 3564	4812	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	88
PID 4812 wrote to memory of 3564	4812	5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe	88
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89
PID 3564 wrote to memory of 3180	3564	ahdgu.exe	89

C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5f9bbb0be8270c87d659dd29a02e36f5_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Roaming\ahdgu.exe
    "C:\Users\Admin\AppData\Roaming\ahdgu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Roaming\ahdgu.exe
      C:\Users\Admin\AppData\Roaming\ahdgu.exe
      4⤵
      Deletes itself
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ahdgu.exe

Filesize
448KB

MD5
5f9bbb0be8270c87d659dd29a02e36f5

SHA1
7f501afa76566a693d719b15f459721436f19e0b

SHA256
aff278a75b403a2c251e9fc7969afad9c5aea67ea171c2ec5d6f8eb69ee07df6

SHA512
57fb9d80e631eb3907c18e3631928a0ffae86c308f8a773b7daacea3409c8d80b78d81a21019c89ace5ac2142052f77f435695d2ea1ac14d03502c7071e0d7e8

Download Submit
C:\Users\Admin\AppData\Roaming\del.tmp

Filesize
86B

MD5
9d1050b0b4c10ad0f952bf7dea46beaf

SHA1
a4db5f43bb56218c6dc6beba93fa8c42e3259674

SHA256
499d66f5b1b739c459a82671a54594c57b1dd3defda6cab883ba9ee979ab5597

SHA512
1c088ea8202c947b15a8612aebf1b8230b65f9dbe8b528ccfced8132d205a282b36a71cd6d30b5fa91daef25783ec2154d9a2702a6344b2608df1010cd12dfd0

Download Submit
C:\Users\Admin\AppData\Roaming\~check.tmp

Filesize
8B

MD5
f8d641ad4d35c70eb7598a24702d468a

SHA1
f8aa00af59545911badc1aa89c66c8cb621b5179

SHA256
c191159be25f0618cdef4cb538cd90721c96c856096c06575414eeabeb457fe8

SHA512
1fb69838b12ff0a824a9424c384f6a2cb885c61ce1b0fa320eb81619211c415fc2880d128848c00eb6764eb1e80523e9d1a40f747c5547e72f5edc82daf4ebde

Download Submit
memory/3180-30-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/3180-28-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/3180-29-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/3180-35-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-6-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-7-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-5-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-2-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-4-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-3-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4812-33-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads