8c179c812fd6d812a2cc0487ae262e53f07ead61ef5996fedc4dbff793e1cf88

General

Target

8efe38879f708a4f474abea32f862970_JaffaCakes118.exe
Size

83KB
MD5

8efe38879f708a4f474abea32f862970
SHA1

ca7671a6f624f777fc9c1da551120f41af226178
SHA256

8c179c812fd6d812a2cc0487ae262e53f07ead61ef5996fedc4dbff793e1cf88
SHA512

d34b88a70b429fff379057d83c9ec580f34c7ef846687321744e6ac4a95f8e80a8cfa86425b86bddd2f15ff0d392216f644d5388a85f684081c8a73a5e0b4857
SSDEEP

1536:RM1B42icqG3KP0PTguD9TaJ7x4y0XSPpeKZSA5KcWD+:V2hqG3Tp9TM90C2P

Score

8^/10

aspackv2 discovery persistence upx

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	8efe38879f708a4f474abea32f862970_JaffaCakes118.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000800000001703d-8.dat	aspack_v212_v242

Loads dropped DLL 2 IoCs

pid	Process
2648	8efe38879f708a4f474abea32f862970_JaffaCakes118.exe
2672	Svchost.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2648-2-0x0000000000EB0000-0x0000000000ED4000-memory.dmp	upx
behavioral1/memory/2648-1-0x0000000000EB0000-0x0000000000ED4000-memory.dmp	upx
behavioral1/memory/2648-0-0x0000000000EB0000-0x0000000000ED4000-memory.dmp	upx
behavioral1/files/0x000800000001703d-8.dat	upx
behavioral1/memory/2672-13-0x00000000745C0000-0x00000000745E4000-memory.dmp	upx
behavioral1/memory/2672-14-0x00000000745C0000-0x00000000745E4000-memory.dmp	upx
behavioral1/memory/2672-15-0x00000000745C0000-0x00000000745E4000-memory.dmp	upx
behavioral1/memory/2648-18-0x0000000000EB0000-0x0000000000ED4000-memory.dmp	upx
behavioral1/memory/2672-20-0x00000000745C0000-0x00000000745E4000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\2E6B0448.tmp	8efe38879f708a4f474abea32f862970_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	8efe38879f708a4f474abea32f862970_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8efe38879f708a4f474abea32f862970_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	8efe38879f708a4f474abea32f862970_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8efe38879f708a4f474abea32f862970_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8efe38879f708a4f474abea32f862970_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2648

C:\Windows\SysWOW64\Svchost.exe
C:\Windows\SysWOW64\Svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Infotmp.txt

Filesize
720B

MD5
5bfe79f894532b6b1a85edd1cd7d54c4

SHA1
f5c6513f9325bb48bad179dc94878da3c263d2ac

SHA256
33fcf44ff83a9908d8ac88e8200837bef10b78e9367df93073ea84b63d999908

SHA512
ac84e3abc43e8719117b433df9e24d515aa1a203790651d7537b434e4711fdb10f45857a60fa903899f0024d162823c6bc8624af91e904ffa36e7c492ed419bb

Download Submit
\Windows\SysWOW64\2E6B0448.tmp

Filesize
83KB

MD5
dbf07479841535971d622d6679e2579c

SHA1
52a794a08b47cd8706e7d13f7427316562e256c3

SHA256
7cce58578cbf3b21224cd093f0faaa190dd2cbe253c7d65b189d9c6ebe924971

SHA512
83fa0baad5fc3e4f00df81b6d45646542896efe05828a59cde4819393dc4decc71aacf023d14a1ee2835f38a627e16644f394d3b89b9fe6fb19bf31915b39c8e

Download Submit
memory/2648-2-0x0000000000EB0000-0x0000000000ED4000-memory.dmp

Filesize
144KB

Download
memory/2648-1-0x0000000000EB0000-0x0000000000ED4000-memory.dmp

Filesize
144KB

Download
memory/2648-0-0x0000000000EB0000-0x0000000000ED4000-memory.dmp

Filesize
144KB

Download
memory/2648-7-0x0000000074FA9000-0x0000000074FAB000-memory.dmp

Filesize
8KB

Download
memory/2648-6-0x0000000076EDF000-0x0000000076EE0000-memory.dmp

Filesize
4KB

Download
memory/2648-18-0x0000000000EB0000-0x0000000000ED4000-memory.dmp

Filesize
144KB

Download
memory/2672-13-0x00000000745C0000-0x00000000745E4000-memory.dmp

Filesize
144KB

Download
memory/2672-14-0x00000000745C0000-0x00000000745E4000-memory.dmp

Filesize
144KB

Download
memory/2672-15-0x00000000745C0000-0x00000000745E4000-memory.dmp

Filesize
144KB

Download
memory/2672-20-0x00000000745C0000-0x00000000745E4000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing