35d99939ea17bd688e5b40d4b718b2f795a0677d676c95496c1f3009b13c366a

General

Target

88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
Size

134KB
MD5

88bcade2e5682e151ed994dde61b079e
SHA1

8a16ff02ecbc366342a377a26f1d1d0497b1788e
SHA256

35d99939ea17bd688e5b40d4b718b2f795a0677d676c95496c1f3009b13c366a
SHA512

353f2504f061bcca52d66110dd95afde2307c637e7d9a37664ba010c5d50e7984f4616572337caff00f411928e84be52c31283dd679219d0a292d1d41c39f94c
SSDEEP

3072:/jGKwgTLTCKFYnqqeVF8VUodWGTj3RvFWb0J8tgcnmujq2r:rqKF2qDVGVUodpTLhFyEtUfr

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2268-0-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2268-80-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\Q:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\R:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\G:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\K:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\O:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\T:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\I:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\N:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\M:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\E:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\H:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\S:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\U:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\V:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\W:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\X:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\Y:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\J:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\L:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened (read-only)	\??\Z:	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{45C65180-6A88-451F-96C4-D20C913F8CCC}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{45C65180-6A88-451F-96C4-D20C913F8CCC}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2268	88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeSecurityPrivilege	2600	msiexec.exe
Token: SeManageVolumePrivilege	2880	SearchIndexer.exe
Token: 33	2880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2880	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2644	SearchProtocolHost.exe
2644	SearchProtocolHost.exe
2644	SearchProtocolHost.exe
2644	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2644	2880	SearchIndexer.exe	33
PID 2880 wrote to memory of 2644	2880	SearchIndexer.exe	33
PID 2880 wrote to memory of 2644	2880	SearchIndexer.exe	33
PID 2880 wrote to memory of 2768	2880	SearchIndexer.exe	34
PID 2880 wrote to memory of 2768	2880	SearchIndexer.exe	34
PID 2880 wrote to memory of 2768	2880	SearchIndexer.exe	34
PID 2880 wrote to memory of 1688	2880	SearchIndexer.exe	36
PID 2880 wrote to memory of 1688	2880	SearchIndexer.exe	36
PID 2880 wrote to memory of 1688	2880	SearchIndexer.exe	36

C:\Users\Admin\AppData\Local\Temp\88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Drops file in Windows directory
PID:2704

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
  2⤵
  PID:2768
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
  2⤵
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
cf9c2f860937ef409d320b78111a6590

SHA1
0572e7a11c9e818e9626e3e5438abf1728c3e0fa

SHA256
c15a955992021f4640e40f8aa18b459521458b904c2e0153d944f40118b5c660

SHA512
6e50d2894588f79d33ffd93e069d848ef9fe64b5dfbcbc1ed5379768555d5dfed4bc8d9e5cf9a58e56b14e73d80c49363a23966b0fe0ccd8c9e2ff08720618b7

Download Submit
memory/2268-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2268-80-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2880-18-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2880-34-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/2880-60-0x0000000004240000-0x0000000004248000-memory.dmp

Filesize
32KB

Download
memory/2880-61-0x0000000004200000-0x0000000004201000-memory.dmp

Filesize
4KB

Download
memory/2880-67-0x0000000004200000-0x0000000004208000-memory.dmp

Filesize
32KB

Download
memory/2880-69-0x00000000041B0000-0x00000000041B1000-memory.dmp

Filesize
4KB

Download
memory/2880-78-0x0000000004250000-0x0000000004258000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing