286dafc16f49f6bddbbea7c1742ee1e9c6925192375d8826e96bca567b1a6b39

General

Target

85e236513aae869c73619683810ec268_JaffaCakes118.exe
Size

20KB
MD5

85e236513aae869c73619683810ec268
SHA1

50ea049426bfc7c9d994fa5576bd1d9b482ab281
SHA256

286dafc16f49f6bddbbea7c1742ee1e9c6925192375d8826e96bca567b1a6b39
SHA512

13929da5d7c7de83f063fe2a93b3bdc17d2b82d67c5c2eb16fed4b11371860ea62c4308bdadad2c4b46eea0c217dae7b658f320ee21c7e885e86cc493a9b1d3b
SSDEEP

384:WUd/oFCgj9c2VZaa7xmmeiuvMb4PkWJwxoBzmEYDoU2:dwFbhhVHtDuvimVmd

Score

8^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\benhack.dll"	85e236513aae869c73619683810ec268_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4184-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4184-8-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\benhack.dll	85e236513aae869c73619683810ec268_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85e236513aae869c73619683810ec268_JaffaCakes118.exe

Runs regedit.exe 1 IoCs

pid	Process
5004	regedit.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4232	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	84
PID 4184 wrote to memory of 4232	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	84
PID 4184 wrote to memory of 4232	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	84
PID 4184 wrote to memory of 1736	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	85
PID 4184 wrote to memory of 1736	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	85
PID 4184 wrote to memory of 1736	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	85
PID 4184 wrote to memory of 2472	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	88
PID 4184 wrote to memory of 2472	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	88
PID 4184 wrote to memory of 2472	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	88
PID 4184 wrote to memory of 4392	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	90
PID 4184 wrote to memory of 4392	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	90
PID 4184 wrote to memory of 4392	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	90
PID 4184 wrote to memory of 64	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	92
PID 4184 wrote to memory of 64	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	92
PID 4184 wrote to memory of 64	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	92
PID 4184 wrote to memory of 4656	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	95
PID 4184 wrote to memory of 4656	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	95
PID 4184 wrote to memory of 4656	4184	85e236513aae869c73619683810ec268_JaffaCakes118.exe	95
PID 64 wrote to memory of 5004	64	cmd.exe	94
PID 64 wrote to memory of 5004	64	cmd.exe	94
PID 64 wrote to memory of 5004	64	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\85e236513aae869c73619683810ec268_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\85e236513aae869c73619683810ec268_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo on
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Windows Registry Editor Version 5.00>>kill.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo [HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon]>>kill.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo "MonAccess"=dword:00000000>>kill.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regedit /s kill.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s kill.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del kill.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kill.txt

Filesize
86B

MD5
758523683116d926f6db291f60e84172

SHA1
02b5c494d20637ddacddecd8085190b0c94fb124

SHA256
22362792c8630c5699017e9d461f2836030524020bc3863be947c41305cc2019

SHA512
a680e8b8d76dd8ed32cfce681dbe8ab77311f9067a286bb9695df536a985682c7e5d763614d0d24db668875bd685df323330310fb661c257f23e09c9033c74a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\kill.txt

Filesize
114B

MD5
cf767737abf6a44083c35c597b10dd5d

SHA1
c8d83a5fdba630e052c087ed560aa09ea10d9f92

SHA256
f1010ab29c426f8bd168b742ac72ed28656ef114e9a16f7cb69a2b8cd186fb61

SHA512
67b5f01f6d3b053177ddf811c39fb4fa829a19fa4ad0814fac945ea134e52ca9c4ef8cf82796ec69162f07edb9e1b1024c4ab16ec2612b9a53d05db9f0af6f1f

Download Submit
memory/4184-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4184-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing