4e66403a14ee87c5b62f4bfbb511ea97dcb025ff83046396e19a68010a1504c4

General

Target

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
Size

331KB
MD5

6d0e4c5ef82e34b53b10552094a5f274
SHA1

c081c29c5ea4e1dd29d39c533c2fc50edb5a1287
SHA256

4e66403a14ee87c5b62f4bfbb511ea97dcb025ff83046396e19a68010a1504c4
SHA512

cdba1676ca6f79d082602a2ed3111879154f9f2bba8e221e8520bbdc642514915926aac8c4f55832039ba842aef1296aac7293aba6ad4ba5ac95019fcf54af87
SSDEEP

6144:nuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLnFIyryb8bJzy5x:u6Wq4aaE6KwyF5L0Y2D1PqLF+yJzg

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2416-0-0x0000000000400000-0x00000000004C2000-memory.dmp	upx
behavioral1/memory/2416-17-0x0000000000400000-0x00000000004C2000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2416-17-0x0000000000400000-0x00000000004C2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2416 set thread context of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2932	2768	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

pid	Process
2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

pid	Process
2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exemsiexec.exe

description	pid	Process	procid_target
PID 2416 wrote to memory of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2740	2416	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2768	2740	6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe	31
PID 2768 wrote to memory of 2932	2768	msiexec.exe	32
PID 2768 wrote to memory of 2932	2768	msiexec.exe	32
PID 2768 wrote to memory of 2932	2768	msiexec.exe	32
PID 2768 wrote to memory of 2932	2768	msiexec.exe	32

C:\Users\Admin\AppData\Local\Temp\6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6d0e4c5ef82e34b53b10552094a5f274_JaffaCakes118.exe"
  2⤵
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 268
      4⤵
      Program crash
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\img238743.jpg

Filesize
18KB

MD5
c90f18b7ac47805fbf7adf5615a3c945

SHA1
fb3a3706532b0e1639d4ee32fb6752e1da8d5003

SHA256
1dbf30a7bb58cf2ca069dcfa05e492433d468396236ff4f56e9aab4e6defcc9a

SHA512
c60b9c3daa4c9a3a002efea83028bbce2494c7812121b1fe6fe0d2cd431f3be836a1e08757a52994a0dd9311c8190f1bdf5d3cc6c7ff499c4e2631c46ccc0108

Download Submit
memory/2416-0-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2416-17-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2740-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2740-18-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2740-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2740-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2740-19-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2768-21-0x00000000009A0000-0x00000000009C4000-memory.dmp

Filesize
144KB

Download
memory/2768-22-0x00000000009A0000-0x00000000009C4000-memory.dmp

Filesize
144KB

Download
memory/2768-24-0x00000000009A0000-0x00000000009C4000-memory.dmp

Filesize
144KB

Download
memory/2768-25-0x00000000009B0000-0x00000000009C4000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads