6d68320440b2fb222518cfa195a157e727bde8bea47efe108bc56497aa784230

General

Target

7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe
Size

10KB
MD5

7493e2838513309a374ea5b6722c18a0
SHA1

023c990c303326f909feda4b1c8163c336787422
SHA256

6d68320440b2fb222518cfa195a157e727bde8bea47efe108bc56497aa784230
SHA512

5e4cb39a79cf4745b508d8970a6de6c37aa5de76d0253113ed90bb0d882e540e400c2151fb89793e492d7c6686191ea057960d7f5efb0ba0d7ca5f50ddea9218
SSDEEP

192:MIysA/4ZJeVDHVtNT9t4QBMptivwB12MaQchfKy99EZTHZ:MIysAwZ83NxtbBM3R1XiUZ9

Score

8^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2656	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	mpacklk.exe

Loads dropped DLL 2 IoCs

pid	Process
2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe
2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2280-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x000900000001722b-3.dat	upx
behavioral1/memory/2280-19-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2448-21-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mpacklk.exe	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mpacklk.exe	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mpackl.dll	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2448	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	31
PID 2280 wrote to memory of 2448	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	31
PID 2280 wrote to memory of 2448	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	31
PID 2280 wrote to memory of 2448	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	31
PID 2280 wrote to memory of 2656	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	32
PID 2280 wrote to memory of 2656	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	32
PID 2280 wrote to memory of 2656	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	32
PID 2280 wrote to memory of 2656	2280	7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\mpacklk.exe
  C:\Windows\system32\mpacklk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7493e2838513309a374ea5b6722c18a0_JaffaCakes118.exe.bat

Filesize
210B

MD5
335fe4c6472b063695871b913fc78cbc

SHA1
e1a94a433d591e3056d7d1efc4d5ac0bbcc080a5

SHA256
b9c2a47daa76c21f74fac1aec8b57281a2e3710df3e6d0e3e821a1de63e1a28b

SHA512
60f7db4dad149e37eed7560ac240556c55a68fd0ffa401452b7a4cdc5e48cfcb714e017d103910abe836b831beacdeff99b4b3f7280aed232b2368ee46e1f3c7

Download Submit
\Windows\SysWOW64\mpacklk.exe

Filesize
10KB

MD5
7493e2838513309a374ea5b6722c18a0

SHA1
023c990c303326f909feda4b1c8163c336787422

SHA256
6d68320440b2fb222518cfa195a157e727bde8bea47efe108bc56497aa784230

SHA512
5e4cb39a79cf4745b508d8970a6de6c37aa5de76d0253113ed90bb0d882e540e400c2151fb89793e492d7c6686191ea057960d7f5efb0ba0d7ca5f50ddea9218

Download Submit
memory/2280-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2280-10-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2280-19-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2448-21-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing