af9f1bd2415576d7891c60a201bf9b44f2fb92e66a44822fcd1df60d122c7f0c

General

Target

b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
Size

178KB
MD5

b425f2155ac5a87b25c72e1636650628
SHA1

b0096f0e80da98f39d70f7e7b2b0db6d82047c0b
SHA256

af9f1bd2415576d7891c60a201bf9b44f2fb92e66a44822fcd1df60d122c7f0c
SHA512

4cc59039229f21889ba78cde825bfe9cdb8f002906b78f45c813bfa626ba5eb453d4bcee8b7e5cee572d6d8fad47597e23431e164c974a392fcae9c4a0672b8a
SSDEEP

3072:Fx6UW6tpmJOoIeyqsiM4h2y6oXsdM7ZC49BGRTUfRZbFoBox6IPHeqo3Sc/////u:FxD99qsiGy6o84ZC49ERT2BFIm6UNc/O

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a00000002340d-13.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2988	run.exe

Loads dropped DLL 38 IoCs

pid	Process
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	run.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2988	4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe	84
PID 4064 wrote to memory of 2988	4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe	84
PID 4064 wrote to memory of 2988	4064	b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b425f2155ac5a87b25c72e1636650628_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\run.exe
  C:\Users\Admin\AppData\Local\Temp\run.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa9461.tmp\System.dll

Filesize
10KB

MD5
810f3a0aefe36a9f63e29e604bea91a9

SHA1
2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

SHA256
f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

SHA512
836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa9461.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\run.exe

Filesize
77KB

MD5
8266d67dab14b50bd3ab974a09a1067a

SHA1
a00c42444dd3188746e63f5303a515c10a183b0a

SHA256
567a2be587fb87dade0d7234fbee749f255b5aabd7cf1923fdda15d8e3685c93

SHA512
0211290a4c8f4bbe33edd61236441b5286d406b6f25434793ebfb50778bf8efee4ff9da4e08b377dda9a034daf1c6ca2e8dcf4eba8dc9ea17254ad9b43f5892a

Download Submit
memory/2988-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2988-163-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing