4fc39fee451b9de41f88cae4c96bf3fff361637409c603f2f54fc79eb418c7f5

General

Target

a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
Size

15KB
MD5

a73eb5ba4144f2955152edf2d016dc1e
SHA1

2210b781e0f9da2b679adda10c920968d7002815
SHA256

4fc39fee451b9de41f88cae4c96bf3fff361637409c603f2f54fc79eb418c7f5
SHA512

a4d6b19ecfc35880840249641ddc1703f84184d622f1ecca38c3324e8175d28f6aeb52cdd84ce549b5da02dbbacb927f4d8f1394982cd0c1aa52ffe772051f94
SSDEEP

384:ViBMOQ2UWYYOyybMYqoSdzvdXzTtq+XS1aeyC:VlOQo5SDxAvdX/XSTy

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4648-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4648-9-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xdndn.cfg	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xdndn.dll	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xdndn.dll	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\jmkcgt.dll	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\jmkcgt.dll	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
Token: SeDebugPrivilege	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3376	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe	55
PID 4648 wrote to memory of 3376	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe	55
PID 4648 wrote to memory of 2888	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe	88
PID 4648 wrote to memory of 2888	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe	88
PID 4648 wrote to memory of 2888	4648	a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3376
- C:\Users\Admin\AppData\Local\Temp\a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\a73eb5ba4144f2955152edf2d016dc1e_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdndn.dll

Filesize
26KB

MD5
35d7a77e86fa9ee6f0d0949f06143370

SHA1
ea4343c6cf57ee637e48fe2a9ca0f79883629bae

SHA256
e5cafbf674a05e4b15fcb2e7dfb8ef8ba544ad32b7da16826ccb8307b61b3a1a

SHA512
0ad2059f64ff9f7e847067ce04fdc9b9e4c0e60856f6b8c38d9c5c905e243de9f5da475448aa246a94974e3936035a787301c814b34b74bdad4379df4e24069f

Download Submit
memory/4648-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4648-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing