4970b915ad357850314fb64763ed070cca3ea29bc49c9c7fc103fa234ee7ce2e

General

Target

ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe
Size

203KB
MD5

ae0ad6771cc433aed684ddc146503e24
SHA1

d2434981d390732553d209d9fe7b7e47d444b4d9
SHA256

4970b915ad357850314fb64763ed070cca3ea29bc49c9c7fc103fa234ee7ce2e
SHA512

f41d5a52552bc1980db6a84409302d3b4e4fcb679e424f871f27682205f48b87eac49517e080bd9280ac3557e37706e16b37e486f1b4d1cdace39238223780f2
SSDEEP

3072:TcoBGFFvb5e5LtKFv2YNmsqcU3+EmLEp0aGEdcKo0QCHsYKZKGZ5e45:AoQFFU50MArU3+EmLC0ahdcR0/iX5f5

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-0-0x0000000000400000-0x0000000000497000-memory.dmp	upx
behavioral1/memory/2192-8-0x0000000000400000-0x0000000000497000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1468	SCHTASKS.exe
1512	SCHTASKS.exe
2260	SCHTASKS.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1468	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1468	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1468	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1468	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1512	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	31
PID 2192 wrote to memory of 1512	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	31
PID 2192 wrote to memory of 1512	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	31
PID 2192 wrote to memory of 1512	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2260	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	32
PID 2192 wrote to memory of 2260	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	32
PID 2192 wrote to memory of 2260	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	32
PID 2192 wrote to memory of 2260	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	32
PID 2192 wrote to memory of 2588	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2588	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2588	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2588	2192	ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ae0ad6771cc433aed684ddc146503e24_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /TN Tasker /TR "wscript.exe /B """C:\Users\Admin\sec.vbe"""" /SC ONLOGON /RL HIGHEST"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1468
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /TN Wisker /TR "wscript.exe /B """C:\Users\Admin\nebp.vbe"""" /SC ONLOGON /RL HIGHEST"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1512
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /SC minute /mo 30 /TN Parker /TR "wscript.exe /B """C:\Users\Admin\AppData\Roaming\msddn.vbs"""" /RL HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2260
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe /B "C:\Users\Admin\AppData\Roaming\msddn.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\idt

Filesize
15B

MD5
4dfb1d9e1856c35f2b0fcaba44a578bf

SHA1
ec3f764747438be9c60054ef6d429db0907d16bc

SHA256
150e3e7a9764065ee02f76eb51bea6be01f201d476a9112f950e95c2b9fe14df

SHA512
772e922501bb080e9bf28a55be5d6c3c70773fb153a1d4d4ce150b6a9e195bd887341207ad6583226dfdf721459be88789337a136084f9ded88224b643a120a6

Download Submit
C:\Users\Admin\AppData\Roaming\msddn.vbs

Filesize
9KB

MD5
3bd7da82097d92b7be22820025f84336

SHA1
858c478c76656f237ca281acea9b8af8ae52d35c

SHA256
6ce9de99bb99861faed30007d53c3bb45210309a7205859730c2ef28e3d86222

SHA512
8dcfa810254ff395f11b07e31b56df84cf84f709d1dd0ef58012303113108085cc84b0936e30e677e92e7efae557da9ac5c38410ec124d1b68a3de348b2884d6

Download Submit
memory/2192-0-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2192-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2192-8-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2192-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads