5e34b7e06b96462bc06e3da56949b157c0e7f250eef60fda21b661e5257f921b

General

Target

89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe
Size

96KB
MD5

89505d28eca47dfa51e4644cd110aa46
SHA1

fdbff2035bc79835e17b44ae65fa55539f9c76bb
SHA256

5e34b7e06b96462bc06e3da56949b157c0e7f250eef60fda21b661e5257f921b
SHA512

4a2e776237058db0f1309a747fb2e9a0c6126fbd93bb89cfa471c729adc5eaf13b5f94ae671cbfb5fdeb2fc064e6d5d08dff77908e7b14b98641b27f43d6a246
SSDEEP

1536:wlSyEtzUUb8Z6XnDs9OilgbiS4pN9WmCNWych5NybFungOzp+edWTgLrpp:Q8UJ6XnY9KinsNWychLybQngwUY

Score

8^/10

aspackv2 discovery persistence upx

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	07ed253c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	07ed253c.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00090000000233e3-3.dat	aspack_v212_v242
behavioral2/files/0x0007000000023441-9.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3120	07ed253c.exe

Loads dropped DLL 12 IoCs

pid	Process
5052	svchost.exe
1800	svchost.exe
4796	svchost.exe
4492	svchost.exe
2836	svchost.exe
1604	svchost.exe
1988	svchost.exe
2432	svchost.exe
2556	svchost.exe
4656	svchost.exe
1476	svchost.exe
3788	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/2548-40-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/2548-59-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	07ed253c.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	07ed253c.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07ed253c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3120	07ed253c.exe
3120	07ed253c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3120	2548	89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe	84
PID 2548 wrote to memory of 3120	2548	89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe	84
PID 2548 wrote to memory of 3120	2548	89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89505d28eca47dfa51e4644cd110aa46_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\07ed253c.exe
  C:\07ed253c.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5052

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1800

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4796

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2836

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1604

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1988

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2556

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1476

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\07ed253c.exe

Filesize
56KB

MD5
38042542a44c5c7802ebd64858beff09

SHA1
cd7658b7e406722c64118cd79d3da1f8c4a53039

SHA256
d559962bbcf33aac15d12d4bc61e4a05489c1fc12ee977a40558c83956ded87f

SHA512
c4647f43d522c02828cb30a900bf59fd6a79a054acc08d0eebf5dfa5bb2d3625b9ea25a26745e2d4bef72f76ceace7c867c34383136dee086782127bed3f74c0

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

Filesize
56KB

MD5
dee124542eb7bf356038f9ccaeee0f95

SHA1
b8c880ba0a12511d7f5f4fb768c6f9e8e109ac52

SHA256
faa8389e0ed8385ab335848f0100bc0a27c5183ad43d76ffe135d1ad31b7eb9b

SHA512
77e24e497ed3b4bc7cabd986da2ec2b3496def77dd0dd36648806331542f036a141fa08471255eaa64fb6c9b14a32df4a34fc218d92d015d30f5779f163ac1ae

Download Submit
memory/1476-79-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/1476-77-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/1604-44-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/1604-46-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/1800-17-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/1800-18-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/2432-58-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/2432-57-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/2432-56-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/2548-40-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2548-59-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2548-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2556-65-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/2556-64-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/2836-37-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/2836-39-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/3120-6-0x0000000000FC0000-0x0000000000FDC000-memory.dmp

Filesize
112KB

Download
memory/3120-4-0x0000000000FC0000-0x0000000000FDC000-memory.dmp

Filesize
112KB

Download
memory/3120-27-0x0000000000FC0000-0x0000000000FDC000-memory.dmp

Filesize
112KB

Download
memory/3788-84-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/3788-86-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/4492-33-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/4492-31-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/4656-71-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/4656-70-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/4656-73-0x0000000074F60000-0x0000000074F7C000-memory.dmp

Filesize
112KB

Download
memory/4796-23-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/4796-24-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/4796-26-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/5052-11-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download
memory/5052-12-0x0000000073B40000-0x0000000073B5C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing