f843d958bf421582dc1239715b17a10985b3d3c3c06053f7bdd42bf4b2b90a63

General

Target

b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
Size

183KB
MD5

b9106d727ddb3b63f7d3f38c09c8cce3
SHA1

d0c4174c241c1e3e1bf2edac1512725704d9466f
SHA256

f843d958bf421582dc1239715b17a10985b3d3c3c06053f7bdd42bf4b2b90a63
SHA512

5de1ea6a55bbe92ac264d599f439db248b685b8bbdcd6e9f157607dcb99f1648a40cc4e30c06dbe2cb44ed81fc4bfb3fb1d895d5db244836d94ed217b7215db5
SSDEEP

3072:EamFnQYUM6m3SP2sVSdEnfWZN3cbgonk9sX1qalYuhLJNdjQVVTuP5J85Vi9iqVF:Eazq3aipalYuhoao5sQkzyg

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0\goicfboogidikkejccmclpieicihhlpo jimddp = "electronic-group"	iaccess32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00050000000193e6-29.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3024	iaccess32.exe

Loads dropped DLL 3 IoCs

pid	Process
2928	regsvr32.exe
3024	iaccess32.exe
3024	iaccess32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x000900000001225f-5.dat	upx
behavioral1/memory/2348-7-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3024-8-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00050000000193e6-29.dat	upx
behavioral1/memory/2928-31-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral1/memory/3024-85-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_go_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e.ico	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20110203210201\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_1_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_2_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_3_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\Common\module.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_logo_2.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\instant access.exe	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\iaccess32.exe	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaccess32.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iaccess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
3008	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
3024	iaccess32.exe
3024	iaccess32.exe
3024	iaccess32.exe
3024	iaccess32.exe
3024	iaccess32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3024	2348	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	31
PID 2348 wrote to memory of 3024	2348	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	31
PID 2348 wrote to memory of 3024	2348	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	31
PID 2348 wrote to memory of 3024	2348	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	31
PID 3024 wrote to memory of 3008	3024	iaccess32.exe	32
PID 3024 wrote to memory of 3008	3024	iaccess32.exe	32
PID 3024 wrote to memory of 3008	3024	iaccess32.exe	32
PID 3024 wrote to memory of 3008	3024	iaccess32.exe	32
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33
PID 3024 wrote to memory of 2928	3024	iaccess32.exe	33

C:\Users\Admin\AppData\Local\Temp\b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:3008
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Instant Access\Multi\20110203210201\Common\module.php

Filesize
5KB

MD5
fe890c8a880a5f73cd3bb220626314e1

SHA1
ffc39cf5c99abd76f819d4020cc1b1debfee78c2

SHA256
721b6589cab9dc800bce06f4eeb12d6143a2f6687386167294629a2ecb12d5dc

SHA512
de6c6b4805a0436f6d573fe3092e1cff68a460e4c9fb14078933ff13634bc353a9abce290d1d2702dad34f0d7c2c15738c5a6c22ba704935569c4fd6901c661a

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110203210201\dialerexe.ini

Filesize
625B

MD5
189f4cf99b0241fa7b89f89e6f8967a8

SHA1
88faad1842e6ae614a092ccf0e96d353427af583

SHA256
6ea1a8f4f01ef4690eea2926857a30bfc0140ba56de52d5d4604e79954fbe4e7

SHA512
696039c95a7cd2a7074d0e4d42b493311d9aaab5f620e957edc8472007435bff37615e93e4783356e1ea26378ead2d60ebc18f28fe2c8af1b14c8897e4c9fd9c

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e.ico

Filesize
766B

MD5
d458cbc6440e490ab1b175806b3f6aa3

SHA1
e2a30e34b9dea7b0fbe30b5bac7f26932cda12dc

SHA256
218eef51d18305b76ba38b8f3db2cf04d085d69b93dbd37a5fa62579b5c46197

SHA512
3138f2cd5e6e1e63feb2e5f00a75b7d2490df4eeeef1a5e4c5e7161253969c1136fe16f914e1daf0320649a4934c670eafb5cdc5b2cc542bc8290361cb4dcadb

Download Submit
C:\Users\Public\Desktop\NOCREDITCARD.lnk

Filesize
2KB

MD5
8a48cebcaafeb0e548c0bb1cb662d582

SHA1
0a5e1b527420063dba628386313a3c719487d542

SHA256
1753c37fd48e31ea6ce351f6645199fbaea51d88d7f9a8597eb47430460b48db

SHA512
184eeedcd5f9c6b666aec50b77f2421738cc56ae4e929f4e986382288e8f12a9610ceca95336e219d091ab01c2156500a27e9180847a182484f846026a35ea24

Download Submit
C:\Windows\SysWOW64\egaccess4_1071.dll

Filesize
76KB

MD5
b83f652ffa76451ae438954f89c02f62

SHA1
b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

SHA256
f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

SHA512
965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

Download Submit
C:\Windows\iaccess32.exe

Filesize
183KB

MD5
e7201b3cffd2861ad9f3e64cdba2ea6f

SHA1
46ccb89d9e50b8bcbf34f2e56d2cf086d053625b

SHA256
51b762b78fcfee317ae54538c4784c1fd53346ec7a4705811109d4e61cf4dcd7

SHA512
fc41110c159c213af1a51872a815226bcd820eb4b8ccda6d28903af9adc84959cd3c3c0e0236f605118a53877d7f5af421d565ea1bcc1df487b6f43be1d60415

Download Submit
C:\Windows\tmlpcert2007

Filesize
6KB

MD5
b103757bc3c714123b5efa26ff96a915

SHA1
991d6694c71736b59b9486339be44ae5e2b66fef

SHA256
eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

SHA512
d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

Download Submit
memory/2348-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2348-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2928-31-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/3024-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3024-54-0x0000000002160000-0x0000000002170000-memory.dmp

Filesize
64KB

Download
memory/3024-45-0x0000000002160000-0x0000000002170000-memory.dmp

Filesize
64KB

Download
memory/3024-85-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing