d50e5c14e78fdab6e6bc1ced85ae1fe371165a9e08456416245fa59e446650a8

General

Target

b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe
Size

117KB
MD5

b9f0304c67af7496a06709a83dd7d24b
SHA1

51b65a241f11a407a162149d345677728622db4a
SHA256

d50e5c14e78fdab6e6bc1ced85ae1fe371165a9e08456416245fa59e446650a8
SHA512

c0672118c1852e957df8a3684a4f5574a34932471698a0501ae3e14b4cbe953852aa512c1223bcd76e1db4664389ab2d6d264e242eb7006d5a9a365a01e014ff
SSDEEP

3072:onOdwVXY92AKUZ7xFcKbY0m3rY/I6i80EXMM5dxq:oOdwVXYD97sKsvkI6i80EXMSdxq

Score

8^/10

discovery persistence upx vmprotect

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xacbfave\Parameters\ServiceDll = "C:\\Windows\\system32\\xacbfave.dll"	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3952	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4044-0-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/4044-1-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/4044-8-0x0000000000400000-0x0000000000440000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0008000000023445-5.dat	vmprotect
behavioral2/memory/3952-7-0x0000000010000000-0x000000001002D000-memory.dmp	vmprotect
behavioral2/memory/3952-9-0x0000000010000000-0x000000001002D000-memory.dmp	vmprotect
behavioral2/memory/3952-10-0x0000000010000000-0x000000001002D000-memory.dmp	vmprotect

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xacbfave.dll	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File created	C:\Windows\SysWOW64\xacbfave.dll	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3256	cmd.exe
4016	PING.EXE

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4016	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3256	4044	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe	86
PID 4044 wrote to memory of 3256	4044	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe	86
PID 4044 wrote to memory of 3256	4044	b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe	86
PID 3256 wrote to memory of 4016	3256	cmd.exe	88
PID 3256 wrote to memory of 4016	3256	cmd.exe	88
PID 3256 wrote to memory of 4016	3256	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping localhost -n 1 && del "C:\Users\Admin\AppData\Local\Temp\b9f0304c67af7496a06709a83dd7d24b_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4016

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\xacbfave.dll

Filesize
75KB

MD5
251a36c48418d2af12087a776aeec4ed

SHA1
b7b60b2e6ffd71352a80aee217def6ed724058b5

SHA256
459a9c42fc9d571f89e87c92f21d63143398e6cdbab0696d6f04f79b78437a2a

SHA512
e638a83b4cfc9c836b09879e50653062c3948ed9e0e466e97bd5c71b90e5dcb22f8526dddc6c35b408acbed55155c6745a15731e8234e9fe57917cff92b9632e

Download Submit
memory/3952-7-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/3952-9-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/3952-10-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/4044-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing