a820ac201cabb07a2783d81577e0ffb2e704dc71d480ad5015b5d0ac113584f1

General

Target

7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
Size

268KB
MD5

7239b285377a4c26e69752cea8e26acb
SHA1

9a0bd7f6186b09aa9d65ba995492738142e63dce
SHA256

a820ac201cabb07a2783d81577e0ffb2e704dc71d480ad5015b5d0ac113584f1
SHA512

8a8bfce3c98599ddf42a93a221dfe5b52324adb120ab80a896516256da1f7479c93b154f921aaa4e709d8afafd48aa736d10fc00212a3ee6a4db76a3221a3481
SSDEEP

3072:TOPS46Qrxue+0RHBo9wMmocmWP+UvQ5hx8K5eSsy3isu/SpN6d4IYr6UJ6l4yU:SPS46wHhaYoBu+oGham/uAQfq1J6qy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2132	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.TMP0

Loads dropped DLL 3 IoCs

pid	Process
1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000015f55-5.dat	upx
behavioral1/memory/2132-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2132-16-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.TMP0

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2132	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.TMP0

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2132	1584	7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\7239b285377a4c26e69752cea8e26acb_JaffaCakes118.TMP0
  "C:\Users\Admin\AppData\Local\Temp\7239b285377a4c26e69752cea8e26acb_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\7239b285377a4c26e69752cea8e26acb_JaffaCakes118.TMP0

Filesize
124KB

MD5
89878e4e70535250e396e538695241df

SHA1
e15e9c889a012a8a5834916e48e0ae1762e9b9f5

SHA256
3d98cf9747defa1f2ab52ccd97984ba1c0e42ef5102bf88b725b24ef2ceb7893

SHA512
f3555c8084397fac88fd39b189afd21c6a2df78226c50fe38ae4a2dae233ffc1c466601fd0c2a059fc028066b6bf034389cebd8030e0ddd9011e3281c4abc3a9

Download Submit
\Users\Admin\AppData\Local\Temp\ArmC3FB.tmp

Filesize
64KB

MD5
e99a5f2bf65521137b0276146c2b493a

SHA1
8668f6adc2613bcd8b1403779a707466d4cc6174

SHA256
c000978738a9c544fd3d2689bc8017dd42fdbf9428ae9183c8742baf34dd96c4

SHA512
ddbbc88546f522f3d99f296ac4fb1fdd72e7f6604081ab17f0f16e065f69db01dd2f7b7d249904737d386db6006123dde2965234e36a497cd48394d13b4e758f

Download Submit
memory/1584-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1584-12-0x0000000002CB0000-0x0000000002D04000-memory.dmp

Filesize
336KB

Download
memory/1584-11-0x0000000002CB0000-0x0000000002D04000-memory.dmp

Filesize
336KB

Download
memory/1584-17-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2132-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2132-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2132-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing