ba09d466d5bf208768f6176260fc802aeb957947fb80cfdaea15f91885f5d6b9

General

Target

a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
Size

41KB
MD5

a615505ec033238829f5e57b040f152c
SHA1

95ccd6afc15b2bf9ad60f1d3eee9a8055d9672d1
SHA256

ba09d466d5bf208768f6176260fc802aeb957947fb80cfdaea15f91885f5d6b9
SHA512

438f26cd43d855aa09472ce2fb32cce873283ed9f9f146d36c6a1260dc50e3fcf4a8f5d1414bc7e9113e979dd6c3a61184990f94723ade1ea9d6669be8852b1a
SSDEEP

768:dTf5y6k6ttu+G7udA9BcVcIt0JOITaOFN6ugRGUYqVSoRMsfhKNgcO/NtZ1:dTf5nkqiPI2OIOOb6uYXYqND0gcGtZ1

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	calc.exe
File opened for modification	C:\Windows\SysWOW64\drivers\PCIDump.sys	FontViewer.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2244	calc.exe
1832	s-h.exe
2144	FontViewer.exe

Loads dropped DLL 6 IoCs

pid	Process
2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
2244	calc.exe
2244	calc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015e2f-17.dat	upx
behavioral1/memory/2160-18-0x0000000002900000-0x0000000002910000-memory.dmp	upx
behavioral1/memory/2244-33-0x00000000001B0000-0x00000000001BB000-memory.dmp	upx
behavioral1/memory/1832-56-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FontViewer.exe	calc.exe
File opened for modification	C:\Windows\SysWOW64\FontViewer.exe	calc.exe
File created	C:\Windows\SysWOW64\FontViewer.exe	FontViewer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s-h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FontViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2244	calc.exe
Token: SeIncBasePriorityPrivilege	2144	FontViewer.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2244	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2244	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2244	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2244	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	28
PID 2160 wrote to memory of 1832	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	29
PID 2160 wrote to memory of 1832	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	29
PID 2160 wrote to memory of 1832	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	29
PID 2160 wrote to memory of 1832	2160	a615505ec033238829f5e57b040f152c_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2144	2244	calc.exe	30
PID 2244 wrote to memory of 2144	2244	calc.exe	30
PID 2244 wrote to memory of 2144	2244	calc.exe	30
PID 2244 wrote to memory of 2144	2244	calc.exe	30
PID 2244 wrote to memory of 1208	2244	calc.exe	31
PID 2244 wrote to memory of 1208	2244	calc.exe	31
PID 2244 wrote to memory of 1208	2244	calc.exe	31
PID 2244 wrote to memory of 1208	2244	calc.exe	31
PID 1832 wrote to memory of 2120	1832	s-h.exe	33
PID 1832 wrote to memory of 2120	1832	s-h.exe	33
PID 1832 wrote to memory of 2120	1832	s-h.exe	33
PID 1832 wrote to memory of 2120	1832	s-h.exe	33
PID 2144 wrote to memory of 1072	2144	FontViewer.exe	32
PID 2144 wrote to memory of 1072	2144	FontViewer.exe	32
PID 2144 wrote to memory of 1072	2144	FontViewer.exe	32
PID 2144 wrote to memory of 1072	2144	FontViewer.exe	32

C:\Users\Admin\AppData\Local\Temp\a615505ec033238829f5e57b040f152c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a615505ec033238829f5e57b040f152c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\calc.exe
  "C:\Users\Admin\AppData\Local\Temp\calc.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\FontViewer.exe
    "C:\Windows\system32\FontViewer.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\FONTVI~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\calc.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
- C:\Users\Admin\AppData\Local\Temp\s-h.exe
  "C:\Users\Admin\AppData\Local\Temp\s-h.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\AE78.tmp\s-h.bat" "
    3⤵
    - Drops file in Drivers directory
    - System Location Discovery: System Language Discovery
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AE78.tmp\s-h.bat

Filesize
162B

MD5
cc4112b4779184b64dd68468284f166c

SHA1
0e05cf48cc6c8b79079b099813655af4b6fcb458

SHA256
fe5801903bbdac7e7d91fa9b09e63ce39ecc044a67e61f28219ee8446bb6c273

SHA512
71e17b067f386c8158b6a8c72372bd7a8cef54415d4d5b00f009222299589c7c8427f9f85ff01c02412a5a2cdf7d9b6b2358d34f257fa8aa548ec805ad2cd103

Download Submit
C:\Windows\SysWOW64\drivers\PCIDump.sys

Filesize
4KB

MD5
7434b98a847fdcb753d8db6341680db7

SHA1
859816f07486ae2ffdffd56f1ff77677bfd14f2b

SHA256
5947ff34e874e7e455cc441b017b11b63fc4fb315b311766fb83070ea7012259

SHA512
8d8de33e245eadabfb2d111aee51dbb0b64238cc82bc1cdd55a440f0f985466d2090a50c6363960bef09b41dd4bdf5888a2a99d37940211b092112ec5030ab53

Download Submit
\Users\Admin\AppData\Local\Temp\calc.exe

Filesize
36KB

MD5
86200148c1e653cf83a3f5a803c6c843

SHA1
a0b4f8172e76b4febaffd39c57254113043ad728

SHA256
3614651cf1d35cf5ac9ef75dfae43de31d37bb3e45934a787a46573db9b765a6

SHA512
c51e50e8319e5c75c2faeea82370dd4fb50a7aafc6b7f5e4ca75cbc6d30f8b4ef98c07123505420b611b5fcd362adee6bc4d0fbd87f9cd6744f9b3cd7e352f47

Download Submit
\Users\Admin\AppData\Local\Temp\s-h.exe

Filesize
21KB

MD5
2c32d65425369efc3e9191dabf5c59ca

SHA1
9047ed37343bcdf519c9905b9a3d894b23940b9a

SHA256
cdcffd3a7a48ae9214214630e19ddb861397edd8ffda23f4ae7eec5aa2518af6

SHA512
048a4890655690d7147e93cc184f70107c20b758038694cf9c7f793993e57f0e7d136635c892adc0633c2aa28e862e26da487633e6ce52dc90c519278d765bc1

Download Submit
memory/1832-56-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2160-0-0x0000000000400000-0x000000000040BD7C-memory.dmp

Filesize
47KB

Download
memory/2160-4-0x0000000000750000-0x000000000075B000-memory.dmp

Filesize
44KB

Download
memory/2160-18-0x0000000002900000-0x0000000002910000-memory.dmp

Filesize
64KB

Download
memory/2160-25-0x0000000000400000-0x000000000040BD7C-memory.dmp

Filesize
47KB

Download
memory/2244-12-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2244-33-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/2244-35-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing