88ea7edad047a68072f017a7ab0cf4ba5864e4708b692abd203752226a0bca1c

General

Target

742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
Size

134KB
MD5

742015029cbefee5cbc4a6a3c17c5454
SHA1

98d4d8a5a3a399c26abf38912ba32fac9583b9e1
SHA256

88ea7edad047a68072f017a7ab0cf4ba5864e4708b692abd203752226a0bca1c
SHA512

35bbf6342c1bb6e0b51181b3b4e0cdbb86b1d026a4ce128418d55a4055c38a87854cedae103bd23ee260c1e8238845335375298dba14f5b91369e8dce3caa82f
SSDEEP

3072:iEN4zPqoAEmbsyzIcKq5p1QVaQn/NsFtiHbFpEuLd/gfn:iE2zjA/zLCVacHTRq

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000016d3a-11.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2276	qxQnImB.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mshtml.dll	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DllCache\mshtml.dllElgsu	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DllCache\mshtml.dll	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dllElgsu	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dll.mod	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshtml.dll.mod	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Elgsu.hwl	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File created	C:\Windows\qxQnImB.exe	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
File opened for modification	C:\Windows\qxQnImB.exe	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2936	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2276	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2276	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2276	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2276	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2460	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2460	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2460	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2460	2936	742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\742015029cbefee5cbc4a6a3c17c5454_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\qxQnImB.exe
  "C:\Windows\qxQnImB.exe"
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 344
  2⤵
  - Program crash
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Elgsu.hwl

Filesize
87KB

MD5
b4f2db9653b0b43dfe5753033a019872

SHA1
09d00b6f67232a24890108f1a202b8ad5d959393

SHA256
f31ac2248cbd7780ef41dd1fd73760293319ebec97d91b1c908ebaff7ba5b953

SHA512
787cb4ee0e1eb0cebb37becdc27b48ec96b790aef7b46ba5562ee84086dac3dd81fa3eb977adfa93a16202baf7b4e56bcb5c616c91dd9bd17f5afa8112eac644

Download Submit
C:\Windows\qxQnImB.exe

Filesize
65KB

MD5
07aaa82f0eaaf460024b23a47f3d951b

SHA1
194e14aa3a5286513b0435504eac2d2c0bb2fa83

SHA256
6a868501751d50ef7c86957d2cefddd4cf95d386585424a1a63f306006ea7980

SHA512
3dcb45cf3d2dc14ec4a993f8aa205e083cc19a1524181e4e98ac0067ffc71aeadb8e4b032f93149138091b41d64f40acf50a207122d8677bf66eacd7ffd12bd2

Download Submit
memory/2276-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2276-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2276-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2276-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2276-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2276-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2936-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2936-13-0x0000000000730000-0x0000000000750000-memory.dmp

Filesize
128KB

Download
memory/2936-12-0x0000000000730000-0x0000000000750000-memory.dmp

Filesize
128KB

Download
memory/2936-27-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing