1a13547b8c165440985ff1531d2a36ed7f4849f9ea2d446f0d55ecf4e9850dd1

General

Target

8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe
Size

14KB
MD5

8477dad6655b7d06b732cc4b93b2b827
SHA1

e40852825120ff4d0c1f5c6baeb5dc1cb47c813f
SHA256

1a13547b8c165440985ff1531d2a36ed7f4849f9ea2d446f0d55ecf4e9850dd1
SHA512

d0284e139221a1cff0ae6e66b8be624052837df4625947fe3ffb8ac4b775618fe85bd0b7648fa2ea2087bc043f7a1e1cf9a8cd9870febc6f89f317dfbd434fa5
SSDEEP

384:JQMtki1VCQtL8DAFeTr4+s2htKSGpX/t:jki/CQG4Cr/hzGpX

Score

8^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2752	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2044	craoek.exe

Loads dropped DLL 2 IoCs

pid	Process
1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe
1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1344-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x00070000000186be-3.dat	upx
behavioral1/memory/2044-12-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/1344-13-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\craoe.dll	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\craoek.exe	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\craoek.exe	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2044	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	29
PID 1344 wrote to memory of 2044	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	29
PID 1344 wrote to memory of 2044	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	29
PID 1344 wrote to memory of 2044	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	29
PID 1344 wrote to memory of 2752	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	30
PID 1344 wrote to memory of 2752	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	30
PID 1344 wrote to memory of 2752	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	30
PID 1344 wrote to memory of 2752	1344	8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\craoek.exe
  C:\Windows\system32\craoek.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Privilege Escalation

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8477dad6655b7d06b732cc4b93b2b827_JaffaCakes118.exe.bat

Filesize
210B

MD5
fb0c7c2c7662ddb95103d4f9a7a90364

SHA1
ee01c3da2c72d00688aae44c777f4e7f8326a311

SHA256
8f8b5ff6bed365fd4d760cc67b4dc3028d403bb05273db28fe4d57fe9247b6a8

SHA512
35853798b735e6e6182dba65c59def5d57efc55963a3a5eb562240c02107106c22707cdbc0921292fa4090381c6e21342412cb31bec74a30424366e363f18d6d

Download Submit
\Windows\SysWOW64\craoek.exe

Filesize
14KB

MD5
8477dad6655b7d06b732cc4b93b2b827

SHA1
e40852825120ff4d0c1f5c6baeb5dc1cb47c813f

SHA256
1a13547b8c165440985ff1531d2a36ed7f4849f9ea2d446f0d55ecf4e9850dd1

SHA512
d0284e139221a1cff0ae6e66b8be624052837df4625947fe3ffb8ac4b775618fe85bd0b7648fa2ea2087bc043f7a1e1cf9a8cd9870febc6f89f317dfbd434fa5

Download Submit
memory/1344-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-10-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1344-11-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1344-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-17-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1344-18-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2044-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing