c35f24e6f78bee40ec8bd2d41d58c5d9b8c9babea38ff74e90a4862cf4099bf8

General

Target

aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe
Size

1.0MB
MD5

aab845b9d94670240c4129d6f47995fd
SHA1

a1817574ab831ff94431347af10922f30c0fff82
SHA256

c35f24e6f78bee40ec8bd2d41d58c5d9b8c9babea38ff74e90a4862cf4099bf8
SHA512

d54ffe3aaee0e176f19e6fcd0481d020e5e8b3fc4917b346a7f65b3646bb2099afe2cff00166b00cfd129c76e1dc33d6a4c32ef96a17958877491029adaf7f55
SSDEEP

24576:VpjGuiW/93JZIiFhbtZS4mIZhShXvscmid+RII1HOQT5wq:V9BNrthbtZiIuhXXN8RZHOQT5wq

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000175ab-7.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
276	aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/276-9-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/files/0x00090000000175ab-7.dat	upx
behavioral1/memory/276-12-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/276-14-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/276-13-0x0000000010000000-0x000000001003D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	276	aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
276	aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe
276	aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe
276	aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aab845b9d94670240c4129d6f47995fd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/276-19-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-14-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/276-0-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-9-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/276-2-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-12-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/276-3-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-13-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/276-11-0x0000000010009000-0x000000001000A000-memory.dmp

Filesize
4KB

Download
memory/276-15-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-1-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-17-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-29-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-23-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-25-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-27-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-21-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-30-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-32-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-34-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-36-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-38-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-40-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/276-42-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing