01f9c2319d337672dc52edce7c8a1da2c5058e9bd338681a4a58bcbae6b9a0c5

General

Target
7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe
Size 1.3MB
Sample240727-bl3awazfpb
SHA256 01f9c2319d337672dc52edce7c8a1da2c5058e9bd338681a4a58bcbae6b9a0c5
MD5 7682cc2ceb95e1bcb49afa3bbc3ed95f
SHA1 2da54e2cb09d13c2a3d4c240d3d0efad48690083
SHA512 28ff749faa38c389e22f17cef1e5861873d3b805406bf847d543cd1bac53f089f94943d2e6b1bdfcdcd16c33736051e91adbf869c13d96aca6102475ee743cb9
SSDEEP 24576:ttTG2juRDu2KFpKi+1Qn4jPzQgq5O3CROcoXtbuuJh/H4+dWBGqw0I7AESrFhRQ6:DTGaUD2Fgi+5PzQE+ORT94fg0SURQ6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion themida upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002349e-23.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1916	DN¿ËÁÖ¶Ù.exe
3052	222.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Wine	DN¿ËÁÖ¶Ù.exe

Loads dropped DLL 1 IoCs

pid	Process
1516	rundll32.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000002349c-5.dat	themida
behavioral2/memory/1916-13-0x0000000000400000-0x0000000000711000-memory.dmp	themida
behavioral2/memory/1916-29-0x0000000000400000-0x0000000000711000-memory.dmp	themida

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002349e-23.dat	upx
behavioral2/memory/1516-25-0x0000000010000000-0x000000001000B000-memory.dmp	upx
behavioral2/memory/1516-28-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dxe.dat	222.exe
File created	C:\Windows\SysWOW64\dinput8.dll	rundll32.exe
File created	C:\Windows\SysWOW64\dllcache\dinput8.dll	rundll32.exe
File created	C:\Windows\SysWOW64\dinput8_.dll	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\dinput8.dll	rundll32.exe
File opened for modification	C:\Windows\dinput8.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1464	1516	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DN¿ËÁÖ¶Ù.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe
528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1916	528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe	86
PID 528 wrote to memory of 1916	528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe	86
PID 528 wrote to memory of 1916	528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe	86
PID 528 wrote to memory of 3052	528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe	87
PID 528 wrote to memory of 3052	528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe	87
PID 528 wrote to memory of 3052	528	7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe	87
PID 3052 wrote to memory of 2760	3052	222.exe	88
PID 3052 wrote to memory of 2760	3052	222.exe	88
PID 3052 wrote to memory of 2760	3052	222.exe	88
PID 2760 wrote to memory of 1516	2760	cmd.exe	90
PID 2760 wrote to memory of 1516	2760	cmd.exe	90
PID 2760 wrote to memory of 1516	2760	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7682cc2ceb95e1bcb49afa3bbc3ed95f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\Temp\DN¿ËÁÖ¶Ù.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp\DN¿ËÁÖ¶Ù.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\Temp\222.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp\222.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sdfd3.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzg1.tmp Run
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 716
        5⤵
        Program crash
        
        PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1516 -ip 1516
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

222.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\222.exe
Size 32KB
SHA256 55785c5e81a4d8713d51025bd825997183da9584069c69b50e03e9986a4aa068
MD5 bc3176933a6f74064e836d62c2485ff8
SHA1 2bfb2b82a277c222b5757ea21eb915d171207861
SHA512 83357dd0631a6f66e1a0bcb110a934c47cee9f1da33d29e607f699b8566c0cfe37af0169a143ac9aae17059bede72adb6271b81eae0ce0d91531a2fd4f3f1d6a
SSDEEP 192:RaGjwp/P1oynBT9bRt52liqtD0kMc3BFWZQ+Tvvjzfjqk4YqOA7l:sGspH1v5bRb4iq113fe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DN¿ËÁÖ¶Ù.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\DN¿ËÁÖ¶Ù.exe
Size 1.3MB
SHA256 35a5d18cc1856371e03684c66c9776b6dbb7f750790b4f3b5ebf490d2eaddcb7
MD5 4d9fbebe1164ffa79d0ebe30c0daa01e
SHA1 e54beb67ef129078ec80b19005b7ed55179bb18b
SHA512 79c2ea736000f3f968ef3f1ad6180eab99a17b93063677eafb19bbd751e85b4e66b1080e4b7bed7db6ba33c0988b71c532b2f668629edd8af62a5cd441bda372
SSDEEP 24576:Ay+UgVmm0VzSVTjyWIUn3qBgEEK8r+XwxoFaCsr3v929NOM5XHbRBIZ4r7/BV:T+Uxm0Vzi5bxK8SWZCsrINx5XNZ/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzg1.tmp

Path C:\Users\Admin\AppData\Local\Temp\lzg1.tmp
Size 11KB
SHA256 5b034c98e7336a7e17637182e09eddfbdd5f5d3e30ea69f00f8e3ad7da950d32
MD5 20ec4f2b2180ca67d0f8d5bde03cb61a
SHA1 9be40abddd2eb0b182be4e748cfb3bd17f4d8a57
SHA512 758ec8b517257c768f8daf32527d6beb98466867d1e9b51b7289981b35e7d559f0680e41bcea89797228ae25b6057f7524d6ad0d97447aecfee113075047df38
SSDEEP 192:lT9bRt52liqtD0kMc3BFWZQ+Tvvjzfjqk4YqOA7l:l5bRb4iq113fe+
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdfd3.bat

Path C:\Users\Admin\AppData\Local\Temp\sdfd3.bat
Size 113B
SHA256 740a88fa95e628578d339df95d57421486f0aaead09e5b6b55e906bc9db63e5f
MD5 58ac5b8b4fd347676442eebe426ca466
SHA1 84602b226bfcd63f83eec5af68130596c2ed7ad0
SHA512 e3fb48f878842bdbc3bd13c5bd22840ea40067dd2b8aae2bf1bd6612ecdbeb5f00b09392c0a9ae2e977beb8e59c8ee331c2e04f0d29be3a38ec24d3ce56253b9
MD5 SHA1 SHA512

Submit Download

memory/1516-25-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/1516-28-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/1916-13-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/1916-29-0x0000000000400000-0x0000000000711000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads