531f96de7d5ffd52f3bf32c6944659f801d285393af5b7e30d8dfbee779807e1

General

Target

b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
Size

2.0MB
MD5

b2e10cde5b4904700db3a48a975b9347
SHA1

e24ea54b140884cf8b7086eac3ab66637ab07636
SHA256

531f96de7d5ffd52f3bf32c6944659f801d285393af5b7e30d8dfbee779807e1
SHA512

b802b52a0a208681ebbe58a92ece071a705837aeaf1fa9be08b298048132f5b4c322fd5097b6867dd8d5fb8f11d73a524b5c52149deae540fd789ee6e751eec2
SSDEEP

49152:V6ajuti/oTr5foomrh0rCyESs33bzHO19uQ:V6Szo/RKrKrCyw3LzvQ

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000016d6c-10.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2676	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2676-0-0x0000000000400000-0x00000000005A5000-memory.dmp	upx
behavioral1/files/0x0009000000016d6c-10.dat	upx
behavioral1/memory/2676-12-0x0000000003550000-0x00000000035AB000-memory.dmp	upx
behavioral1/memory/2676-82-0x0000000003550000-0x00000000035AB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2676	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
2676	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
2676	b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2e10cde5b4904700db3a48a975b9347_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~zm_{836B475D-2DD4-404C-83D1-C7749EB453B7}\css\style.css

Filesize
2KB

MD5
7757619b8df51d677c79395a84e0c539

SHA1
8fa1685f830da61a0f4bbdb1db428f4dbef9c971

SHA256
7c8000bdae47f22b1db799db5e583902737de0fe37bf2581b18bedb63155b1a3

SHA512
3b779b7e4694bf11600b802ea690871f7e65f880c56b5b76fbb0ceede64feee143f6d23031dc485510cb496dad89705999f2e66d4df2390ca318570ff6c7d731

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{836B475D-2DD4-404C-83D1-C7749EB453B7}\images\cellar_bg.jpg

Filesize
548B

MD5
4777779f71fde6d16f6cc99013c8daff

SHA1
312f97b25bd743a8a8d2268bdfd1ac53701345c2

SHA256
46e860286f1f016711f9e6a8b36335ba549c58aadd67322dae897c0f83c06cd2

SHA512
1b4cc3e5613c6bef54b47d23a53315f802a016d5961b81b4eab4012c8da1045fae3af486c97e281f9829d83f9190af29e685be2b3bf3ebc89cbbf0d4fcf5e775

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{836B475D-2DD4-404C-83D1-C7749EB453B7}\images\index_top.jpg

Filesize
26KB

MD5
05c3582a4efb14334262dec9320b8ac3

SHA1
0c6d42c0f417c05ae285327b49002474021e4703

SHA256
48f5f24c3b2b24c244cf7211dd9804557436d6e617d9891e308934f32c2301c1

SHA512
f4532bf0d0676f64dd114139a86049c093c61c3926a929a2652d7f7d724dcb7505c03bbac3687c7a56f313359d5022137ffa25035d69cf2f91a745f867a124d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{836B475D-2DD4-404C-83D1-C7749EB453B7}\page.html

Filesize
1KB

MD5
208bf1089774167723e951ea69f6e60c

SHA1
6749d9193301e617997a0b1db2c5d1441b6477a5

SHA256
e3838c923b1e2f95d8be973d7e149f984bdcd03109648be0a80d1d4ab499e35b

SHA512
d5d42863cc001e2a66ada472e8bac3114a026e1927018f1ecb48e5f21743b4db770360e66522d86c3adb22a73a3e53b7a78e91c47a74135bb35531238d3618e0

Download Submit
\Users\Admin\AppData\Local\Temp\{D2B98E8B-0B34-4723-9336-6ACCDDB299C1}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
memory/2676-12-0x0000000003550000-0x00000000035AB000-memory.dmp

Filesize
364KB

Download
memory/2676-0-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/2676-6-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2676-2-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/2676-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2676-79-0x0000000000400000-0x00000000005A5000-memory.dmp

Filesize
1.6MB

Download
memory/2676-81-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2676-82-0x0000000003550000-0x00000000035AB000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing