194f0f3ab3a0f6b7b1288726b74c06bfd09950723dfb95d5cc6507ccd399ffd8

General

Target

89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
Size

1.5MB
MD5

89ec314f29738590f295e0f34af61a7e
SHA1

ee3f89f7c2c20cef88de8a749523bdb5f68033b1
SHA256

194f0f3ab3a0f6b7b1288726b74c06bfd09950723dfb95d5cc6507ccd399ffd8
SHA512

fdd4b7fbc8a212a1776f0f12b3f715e9ab791eeb87c93c07fe01c1d68ce28625123d5366f76b13923c5125e9166ab23b4cbd722cc7f1373bc050b887d3a50e13
SSDEEP

24576:+eZwMGssPU2phAxv6VOh1CO3nK9ccHJ2rP3xJ7xXDZRQ9eYYTweri:9Z5RVhFDcEP/7xDM9I/+

Score

10^/10

discovery evasion persistence themida

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\Common Files\System\dns.exe = "C:\\Program Files (x86)\\Common Files\\System\\dns.exe:*:Enabled:Windows Update"	dns.exe

Executes dropped EXE 2 IoCs

pid	Process
2876	dns.exe
2596	dns.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Wine	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Wine	dns.exe

Loads dropped DLL 3 IoCs

pid	Process
2308	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
2308	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
2876	dns.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2508-0-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2508-4-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2508-11-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2508-10-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2308-14-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/files/0x0034000000015d88-17.dat	themida
behavioral1/memory/2876-25-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2876-24-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2876-35-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2876-34-0x0000000010000000-0x000000001032C000-memory.dmp	themida
behavioral1/memory/2876-32-0x0000000010000000-0x000000001032C000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Program Files (x86)\\Common Files\\System\\dns.exe"	dns.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2876 set thread context of 2596	2876	dns.exe	31

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\System\dns.exe	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System	dns.exe
File created	C:\Program Files (x86)\Common Files\System\dns.exe	dns.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\dns.exe	dns.exe
File opened for modification	C:\Program Files (x86)\Common Files\System	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\dns.exe	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dns.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
2876	dns.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2308	2508	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	29
PID 2308 wrote to memory of 2876	2308	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2876	2308	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2876	2308	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2876	2308	89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2596	2876	dns.exe	31
PID 2876 wrote to memory of 2596	2876	dns.exe	31
PID 2876 wrote to memory of 2596	2876	dns.exe	31
PID 2876 wrote to memory of 2596	2876	dns.exe	31
PID 2876 wrote to memory of 2596	2876	dns.exe	31
PID 2876 wrote to memory of 2596	2876	dns.exe	31

C:\Users\Admin\AppData\Local\Temp\89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\89ec314f29738590f295e0f34af61a7e_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Common Files\System\dns.exe
    "C:\Program Files (x86)\Common Files\System\dns.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Program Files (x86)\Common Files\System\dns.exe
      "C:\Program Files (x86)\Common Files\System\dns.exe"
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Common Files\System\dns.exe

Filesize
1.5MB

MD5
89ec314f29738590f295e0f34af61a7e

SHA1
ee3f89f7c2c20cef88de8a749523bdb5f68033b1

SHA256
194f0f3ab3a0f6b7b1288726b74c06bfd09950723dfb95d5cc6507ccd399ffd8

SHA512
fdd4b7fbc8a212a1776f0f12b3f715e9ab791eeb87c93c07fe01c1d68ce28625123d5366f76b13923c5125e9166ab23b4cbd722cc7f1373bc050b887d3a50e13

Download Submit
memory/2308-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2308-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2308-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2308-14-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2308-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-3-0x0000000010001000-0x000000001002B000-memory.dmp

Filesize
168KB

Download
memory/2508-4-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2508-11-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2508-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2508-0-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2508-2-0x0000000001BE0000-0x0000000001CDF000-memory.dmp

Filesize
1020KB

Download
memory/2508-10-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2596-38-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2876-25-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2876-24-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2876-35-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2876-34-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download
memory/2876-32-0x0000000010000000-0x000000001032C000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads