0ec380959d1a89d3293b2900debcf159aad8b91a64ed93bd1337040367b8b123

General

Target

aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe
Size

184KB
MD5

aff7fed5d0b167308ad264b0dfc5bef6
SHA1

5d51076b18ff195b2ab52bfc73bce70cc614b8ee
SHA256

0ec380959d1a89d3293b2900debcf159aad8b91a64ed93bd1337040367b8b123
SHA512

32b81e431161366d460ab2f8f237fb6266f44c40a4c5671c1b2dfa22be74de47992037aec7493cba365f1458ccae13eaf3254ee0eccb165723f48ce31c3d21ea
SSDEEP

3072:t3CRCTcyuZAAA12vVpeubAUuyyAu9cGLNUfP6B7kOjLzI40O3J5IWxSblN:t3XuZ5A12vTe4uhlWGyfiB7kNiX/s

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
980	uQbMRDIoHrXyhlzusYWZ.exe
4900	eWTwfvkcRMaSqVALPATe.exe
2052	HbuptnUYIylfZMtjuBZJ.exe

Loads dropped DLL 2 IoCs

pid	Process
4568	rundll32.exe
2996	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1148-0-0x0000000000400000-0x000000000047A000-memory.dmp	upx
behavioral2/memory/1148-12-0x0000000000400000-0x000000000047A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcupebuteb = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Wfctekb.dll\",Startup"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	2052	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eWTwfvkcRMaSqVALPATe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HbuptnUYIylfZMtjuBZJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uQbMRDIoHrXyhlzusYWZ.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe
4568	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 980	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	84
PID 1148 wrote to memory of 980	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	84
PID 1148 wrote to memory of 980	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	84
PID 1148 wrote to memory of 4900	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	85
PID 1148 wrote to memory of 4900	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	85
PID 1148 wrote to memory of 4900	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	85
PID 1148 wrote to memory of 2052	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	86
PID 1148 wrote to memory of 2052	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	86
PID 1148 wrote to memory of 2052	1148	aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe	86
PID 4900 wrote to memory of 4568	4900	eWTwfvkcRMaSqVALPATe.exe	89
PID 4900 wrote to memory of 4568	4900	eWTwfvkcRMaSqVALPATe.exe	89
PID 4900 wrote to memory of 4568	4900	eWTwfvkcRMaSqVALPATe.exe	89
PID 4568 wrote to memory of 2996	4568	rundll32.exe	105
PID 4568 wrote to memory of 2996	4568	rundll32.exe	105
PID 4568 wrote to memory of 2996	4568	rundll32.exe	105

C:\Users\Admin\AppData\Local\Temp\aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aff7fed5d0b167308ad264b0dfc5bef6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\uQbMRDIoHrXyhlzusYWZ.exe
  C:\Users\Admin\AppData\Local\Temp\uQbMRDIoHrXyhlzusYWZ.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:980
- C:\Users\Admin\AppData\Local\Temp\eWTwfvkcRMaSqVALPATe.exe
  C:\Users\Admin\AppData\Local\Temp\eWTwfvkcRMaSqVALPATe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Wfctekb.dll",Startup
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Wfctekb.dll",iep
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2996
- C:\Users\Admin\AppData\Local\Temp\HbuptnUYIylfZMtjuBZJ.exe
  C:\Users\Admin\AppData\Local\Temp\HbuptnUYIylfZMtjuBZJ.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 576
    3⤵
    - Program crash
    PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2052 -ip 2052
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HbuptnUYIylfZMtjuBZJ.exe

Filesize
92KB

MD5
a2d1be32a1c5dfe7767f7f88ef29a4a1

SHA1
933cb9beb566849e8466fb1779844acaf8e5710f

SHA256
80d877df84438bedf1bf62be18e07c3d78be71a916b2dcf67a450bd8dcebf6f8

SHA512
4d2780d7d21ba7c34391792d8da3057ba3e29ed611a87f9fad6c0084a3ba8c96f5c43cf10a87d804639d754dde9cd79ce10b5d31df9ad1d13884496ddcd7c084

Download Submit
C:\Users\Admin\AppData\Local\Temp\eWTwfvkcRMaSqVALPATe.exe

Filesize
67KB

MD5
0350f4f74e02eac9702e14cc777f6a38

SHA1
83d5603c6496efe7d5f85a620c3c14b0b5e172b5

SHA256
a827aab4967b35976202f25da9bb851a8622ae3c58fef21017564e01a0217a87

SHA512
47ee07a206dd0f91f6f9037bbc690698ad11a3ecfcc3d5ade0b3fdb5a06afd4545b8ca806f6a5bc6624e1e09019b579e2f067638906681ef0fa5b8bd0b5864fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\uQbMRDIoHrXyhlzusYWZ.exe

Filesize
26KB

MD5
327a81dd19c332ca9ad8db0c9d46d6d6

SHA1
8a6e6b9555f8acdd819200f26e5abaef221d82fd

SHA256
646e06fc58f4b257a9e8633607b7ef85ccfb7ee1a43149fa536127b1540cde80

SHA512
c013def8c68911cfca13cc2cf9c18786195d38147dcf7f1e4107780211b6f503d6815c71413f88d28b8ec108eec308b2e92c9b834accac53bc7e92afab41208d

Download Submit
C:\Users\Admin\AppData\Local\Wfctekb.dll

Filesize
67KB

MD5
62bbd8e688e2fd8e83bc4dcec28ed216

SHA1
07912d2bb93c3a83a00fd0041f8a72d081b9b189

SHA256
22e8da3c59109f5c2fd3303f567cd3d7e8760b6a446c8d7f3e9c5a59ff5d1a25

SHA512
8648b805094f762e8a3b17d57fc2b3f80a2862deb9ca21dfd6ab66712747b4e9efa0e225bba7deac7b00d84198a5f0176af93b7f0a4c632ec6d56e85e23428ca

Download Submit
memory/1148-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1148-12-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2996-44-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2996-42-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/2996-39-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/2996-40-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/4568-31-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4568-38-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4568-22-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4568-25-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4568-24-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4568-43-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4568-29-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4568-28-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Filesize
64KB

Download
memory/4568-23-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4900-27-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/4900-16-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/4900-17-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4900-30-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4900-15-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/4900-14-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/4900-26-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads