f843d958bf421582dc1239715b17a10985b3d3c3c06053f7bdd42bf4b2b90a63

General

Target

b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
Size

183KB
MD5

b9106d727ddb3b63f7d3f38c09c8cce3
SHA1

d0c4174c241c1e3e1bf2edac1512725704d9466f
SHA256

f843d958bf421582dc1239715b17a10985b3d3c3c06053f7bdd42bf4b2b90a63
SHA512

5de1ea6a55bbe92ac264d599f439db248b685b8bbdcd6e9f157607dcb99f1648a40cc4e30c06dbe2cb44ed81fc4bfb3fb1d895d5db244836d94ed217b7215db5
SSDEEP

3072:EamFnQYUM6m3SP2sVSdEnfWZN3cbgonk9sX1qalYuhLJNdjQVVTuP5J85Vi9iqVF:Eazq3aipalYuhoao5sQkzyg

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023455-26.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	iaccess32.exe

Executes dropped EXE 1 IoCs

pid	Process
3324	iaccess32.exe

Loads dropped DLL 1 IoCs

pid	Process
4168	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3900-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x00090000000233db-3.dat	upx
behavioral2/memory/3324-4-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3900-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0007000000023455-26.dat	upx
behavioral2/memory/4168-28-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral2/memory/3324-71-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_1_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_go_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_2_3.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e.ico	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\instant access.exe	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\dialerexe.ini	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20110203210201\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\Common\module.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_logo_2.gif	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e_3_3.gif	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe
File created	C:\Windows\iaccess32.exe	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaccess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\IESettingSync	iaccess32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	iaccess32.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iaccess32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iaccess32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\À	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
4936	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3900	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
3324	iaccess32.exe
3324	iaccess32.exe
3324	iaccess32.exe
3324	iaccess32.exe
3324	iaccess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3324	3900	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	84
PID 3900 wrote to memory of 3324	3900	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	84
PID 3900 wrote to memory of 3324	3900	b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe	84
PID 3324 wrote to memory of 4936	3324	iaccess32.exe	86
PID 3324 wrote to memory of 4936	3324	iaccess32.exe	86
PID 3324 wrote to memory of 4936	3324	iaccess32.exe	86
PID 3324 wrote to memory of 4168	3324	iaccess32.exe	88
PID 3324 wrote to memory of 4168	3324	iaccess32.exe	88
PID 3324 wrote to memory of 4168	3324	iaccess32.exe	88

C:\Users\Admin\AppData\Local\Temp\b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9106d727ddb3b63f7d3f38c09c8cce3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:4936
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Instant Access\DesktopIcons\NOCREDITCARD.lnk

Filesize
2KB

MD5
a0af51212516f383495d02d1a6e16871

SHA1
a47c040fdff5484139ce472efa2d8241b97a8cba

SHA256
d57b878fe85b9da9beb5b5264e7686de1eac96b09c8a58cab16d1b50bb25f725

SHA512
36da7d1b4fc32af0c03cb8cf7c483db7b6570b30df8da1bc43426e239bbec3d62abf4047c89c700f49db48fa94f980a42b851c587a9617928d4439fcc03b8946

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110203210201\Common\module.php

Filesize
5KB

MD5
fe890c8a880a5f73cd3bb220626314e1

SHA1
ffc39cf5c99abd76f819d4020cc1b1debfee78c2

SHA256
721b6589cab9dc800bce06f4eeb12d6143a2f6687386167294629a2ecb12d5dc

SHA512
de6c6b4805a0436f6d573fe3092e1cff68a460e4c9fb14078933ff13634bc353a9abce290d1d2702dad34f0d7c2c15738c5a6c22ba704935569c4fd6901c661a

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110203210201\dialerexe.ini

Filesize
625B

MD5
189f4cf99b0241fa7b89f89e6f8967a8

SHA1
88faad1842e6ae614a092ccf0e96d353427af583

SHA256
6ea1a8f4f01ef4690eea2926857a30bfc0140ba56de52d5d4604e79954fbe4e7

SHA512
696039c95a7cd2a7074d0e4d42b493311d9aaab5f620e957edc8472007435bff37615e93e4783356e1ea26378ead2d60ebc18f28fe2c8af1b14c8897e4c9fd9c

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110203210201\medias\p2e.ico

Filesize
766B

MD5
d458cbc6440e490ab1b175806b3f6aa3

SHA1
e2a30e34b9dea7b0fbe30b5bac7f26932cda12dc

SHA256
218eef51d18305b76ba38b8f3db2cf04d085d69b93dbd37a5fa62579b5c46197

SHA512
3138f2cd5e6e1e63feb2e5f00a75b7d2490df4eeeef1a5e4c5e7161253969c1136fe16f914e1daf0320649a4934c670eafb5cdc5b2cc542bc8290361cb4dcadb

Download Submit
C:\Windows\SysWOW64\egaccess4_1071.dll

Filesize
76KB

MD5
b83f652ffa76451ae438954f89c02f62

SHA1
b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

SHA256
f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

SHA512
965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

Download Submit
C:\Windows\iaccess32.exe

Filesize
183KB

MD5
e7201b3cffd2861ad9f3e64cdba2ea6f

SHA1
46ccb89d9e50b8bcbf34f2e56d2cf086d053625b

SHA256
51b762b78fcfee317ae54538c4784c1fd53346ec7a4705811109d4e61cf4dcd7

SHA512
fc41110c159c213af1a51872a815226bcd820eb4b8ccda6d28903af9adc84959cd3c3c0e0236f605118a53877d7f5af421d565ea1bcc1df487b6f43be1d60415

Download Submit
C:\Windows\tmlpcert2007

Filesize
6KB

MD5
b103757bc3c714123b5efa26ff96a915

SHA1
991d6694c71736b59b9486339be44ae5e2b66fef

SHA256
eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

SHA512
d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

Download Submit
memory/3324-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3324-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3900-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3900-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4168-28-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing