f5914ee5b036e69743f770dddc238ba29c257b8bd1ba4b389f541885f2f6cea1

General

Target

76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe
Size

738KB
MD5

76fac4d63b938244deba2b5952879cd5
SHA1

5d64cbf8e5ab5b589b290a65c5425f1fddce5a18
SHA256

f5914ee5b036e69743f770dddc238ba29c257b8bd1ba4b389f541885f2f6cea1
SHA512

ffa1918fbb77eef54c097527398e24fd4ad4e3138a4ce9fc1ab3c662e1088b286c51585874c01a4e70feca7c15cdc00085ba3a21690b46ff01518f6bdd82a6b6
SSDEEP

12288:seyi1Ajf8tBO2jZ4O7YEpp11yd/7rWSouiSr9xdyrJG1dy/W0r+qP+bmG:s46jfuBLtn9kZ7rWtE38JG10q6+bm

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
1984	setup_m.exe
3680	setup.exe
3640	winlogon.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000002347d-5.dat	upx
behavioral2/files/0x00070000000234dd-13.dat	upx
behavioral2/memory/1984-14-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral2/memory/3680-19-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/1984-25-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral2/memory/3640-26-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral2/memory/3680-28-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/3640-29-0x0000000000400000-0x00000000005B3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\setup_m.exe"	setup_m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\setup_m.exe"	setup_m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon.exe"	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3640	winlogon.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1984	3696	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe	84
PID 3696 wrote to memory of 1984	3696	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe	84
PID 3696 wrote to memory of 1984	3696	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe	84
PID 3696 wrote to memory of 3680	3696	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe	85
PID 3696 wrote to memory of 3680	3696	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe	85
PID 3696 wrote to memory of 3680	3696	76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe	85
PID 1984 wrote to memory of 3640	1984	setup_m.exe	89
PID 1984 wrote to memory of 3640	1984	setup_m.exe	89
PID 1984 wrote to memory of 3640	1984	setup_m.exe	89

C:\Users\Admin\AppData\Local\Temp\76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\76fac4d63b938244deba2b5952879cd5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Users\Admin\AppData\Local\Temp\setup_m.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_m.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\winlogon.exe
    C:\Users\Admin\AppData\Local\winlogon.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3640
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
55KB

MD5
029bfcce9a9d0dbf6225147a08ec1cb3

SHA1
691fc26c1160c1bf988bca231f0c7d82d7bd5529

SHA256
33ac50f5210294815111561423b847e682bdac815fe19e2353c58030a9539997

SHA512
6d6d1c9a30b1a7f024d8e74368bfb5ba4d22b26d1e3c2bf6b9ce9aa9207b77109708b00abbbec0d4a1b794971582182171a2ca632f8f4e98d3a979e26695cc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_m.exe

Filesize
680KB

MD5
19a433c37ae624147d30b9014c4b4ba7

SHA1
bddd6cd7fecfab450fab90bf0c6f5c3232bce78a

SHA256
97247a9e78bb637c70527b9ccd471de85f4c0b9191de115c7dd338f34010df78

SHA512
9790834837bcacf5a107b7fa881a5ba6e49ee8fd0127c0a96ef0899ce2c065bb5960aaad896106f0755112186521f157301e6d974cbf64b7b4ae80f51aee6609

Download Submit
memory/1984-14-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/1984-25-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/3640-26-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/3640-29-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/3680-19-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3680-28-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3696-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/3696-18-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads