6fba99be7371090f81077cbe3d679d57d27682d52ef96c8d962619add2170b4e

General

Target

a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
Size

282KB
MD5

a2ce6e650a6aa090d2b6411cb8599125
SHA1

5cb36dcad74c647e597d0a74fa605842da6a43d8
SHA256

6fba99be7371090f81077cbe3d679d57d27682d52ef96c8d962619add2170b4e
SHA512

507394d3d13c1be69b110245ad46206d2bcbae3c9a7dad32d79a791c2c4904674723b72337ee56d49d6eab7d04f2c9a729e7817190a2631a2f5ebf36b7bfd936
SSDEEP

6144:Dcu2JbDktc0z0FM3SybA5U7L0tIV2jq42hgN96VQ8VkmHC9E2:DSbQcg0FGS0LeIV2WDaR8V/l

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a0000000234df-2.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1204	G_Server2007

Loads dropped DLL 2 IoCs

pid	Process
1204	G_Server2007
1204	G_Server2007

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\RAV2007.BAT	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
File created	C:\Windows\G_Server2007	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
File opened for modification	C:\Windows\G_Server2007	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
File created	C:\Windows\G_Server2007.DLL	G_Server2007
File opened for modification	C:\Windows\G_Server2007.DLL	G_Server2007

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3692	4928	WerFault.exe	83
1608	1204	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G_Server2007

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	G_Server2007

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1204	G_Server2007
1204	G_Server2007

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4756	4928	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe	93
PID 4928 wrote to memory of 4756	4928	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe	93
PID 4928 wrote to memory of 4756	4928	a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2ce6e650a6aa090d2b6411cb8599125_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 376
  2⤵
  - Program crash
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\RAV2007.BAT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 4928
1⤵
PID:4768

C:\Windows\G_Server2007
C:\Windows\G_Server2007
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 376
  2⤵
  - Program crash
  PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1204 -ip 1204
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\G_Server2007

Filesize
282KB

MD5
a2ce6e650a6aa090d2b6411cb8599125

SHA1
5cb36dcad74c647e597d0a74fa605842da6a43d8

SHA256
6fba99be7371090f81077cbe3d679d57d27682d52ef96c8d962619add2170b4e

SHA512
507394d3d13c1be69b110245ad46206d2bcbae3c9a7dad32d79a791c2c4904674723b72337ee56d49d6eab7d04f2c9a729e7817190a2631a2f5ebf36b7bfd936

Download Submit
C:\Windows\G_Server2007.DLL

Filesize
236KB

MD5
aabc0dda6829aa3b104981fb03de696c

SHA1
27cf8b007f9ff5d29e0e6158932dd342d49f4d60

SHA256
c395e2c651859727d8ad410fc10dd06e1e6feebf9dcaa02543fe1c0106239cc8

SHA512
a6a58394f19c35aed17d9d7c8137925fa3a539d0f189d94932eb13de313d5e6657fe715b25f5e9799a4295bf673b99c7519847c2523810ad2dc5394b89e11747

Download Submit
C:\Windows\RAV2007.BAT

Filesize
218B

MD5
8c592163dfd82fc176d379d605fae6ba

SHA1
ca5c0f8c447d7f994c0baa929fb66139de9c497f

SHA256
99cd6d04422631e816aa1b9da054488dc75680ded973b9b6bca6f1c7dca4cd9f

SHA512
149f24d3e1ff3f4c3124ea506342ab6bacab3cabe3df0dccd6944b8b772b052de6ae0d2e1ded326f5740a6bebf2f78dbad8b79cd073bfb1276f2493e5161a175

Download Submit
memory/1204-13-0x00000000010E0000-0x0000000001230000-memory.dmp

Filesize
1.3MB

Download
memory/1204-15-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1204-16-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1204-17-0x00000000010E0000-0x0000000001230000-memory.dmp

Filesize
1.3MB

Download
memory/1204-19-0x00000000010E0000-0x0000000001230000-memory.dmp

Filesize
1.3MB

Download
memory/1204-20-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1204-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4928-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing