965da94c08c19da21787f84a00e45fa8c83d852c075a0265a1a7314d34ffbade

General

Target

a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe
Size

59KB
MD5

a1b59d03f0a157cfef36e4c35d29e081
SHA1

d283877365574dffe682bbe213451acbb57e4b93
SHA256

965da94c08c19da21787f84a00e45fa8c83d852c075a0265a1a7314d34ffbade
SHA512

42086c2239e3b518b9b19c4b1379ffd9121bbbeabc342710b47e8e3a6656960b468bf72a57d2498c141295efdc83edb200e9de074297340fa1cb8a2d8ecd78f5
SSDEEP

1536:MvU70UUfsjwIXu3/4ZmkBps+LXP6B+Jnouy83O:1zUEjwb3AZ++LXSB+Zout3O

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4884	netprotocol.exe
4484	netprotocol.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3988-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3988-5-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3988-10-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3988-24-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4484-25-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 4884 set thread context of 4484	4884	netprotocol.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netprotocol.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe
4884	netprotocol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3672 wrote to memory of 3988	3672	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	84
PID 3988 wrote to memory of 4884	3988	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	85
PID 3988 wrote to memory of 4884	3988	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	85
PID 3988 wrote to memory of 4884	3988	a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe	85
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86
PID 4884 wrote to memory of 4484	4884	netprotocol.exe	86

C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a1b59d03f0a157cfef36e4c35d29e081_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      "C:\Users\Admin\AppData\Roaming\netprotocol.exe"
      4⤵
      Executes dropped EXE
      PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
59KB

MD5
9a6fe98528ea9a5cc6ee452823c8e44d

SHA1
cc2a5fecbb313bf6e38fa4878834de1124f7dfc0

SHA256
4872c00d72c2785cedbf170172a489ab6aadf6e78bac985fdfba259ed6ce20f6

SHA512
39cc495fed54d8bd2130c6071adb4f3b81a199699dd6d0b5c755f1042049b90e29f6d006bfab99b53bc33afd852c94477a3e27300e2fdddd37cd539da7ec89fd

Download Submit
memory/3672-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3672-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3988-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3988-5-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3988-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3988-24-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3988-32-0x0000000000430000-0x00000000004F9000-memory.dmp

Filesize
804KB

Download
memory/4484-25-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4884-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4884-23-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads