19fc974bdb44320746ac108a840fae635698d31938b164073d91bbafeac00949

General

Target

bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
Size

51KB
MD5

bab06d1595599bc4a04959804a743bab
SHA1

85fa5750aa5dac48fd27462cc05e369b2708d657
SHA256

19fc974bdb44320746ac108a840fae635698d31938b164073d91bbafeac00949
SHA512

94bb6bc33a3937c84a2fedf6f1db6d55e10302e5186c9d1d56d5304f2f0b3db4fb055d6d4dc7ed04ed7c2646877251b2244635f1a68c983280d359c32a5e8a25
SSDEEP

384:ZXPXaQ90vj9k7VDGLl4Twf6mQNll9y/4:ZPaQ2vJk7VyLlYwimQzW/

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000018bac-6.dat	acprotect

Deletes itself 1 IoCs

pid	Process
3064	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
3064	rundll32.exe
3064	rundll32.exe
3064	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x0007000000018bac-6.dat	upx
behavioral1/memory/3064-8-0x0000000010000000-0x0000000010009000-memory.dmp	upx
behavioral1/memory/3004-14-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dazz.dat	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\qrd.dll	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\4322987.ime	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
File created	C:\WINDOWS\SysWOW64\4322987.IME	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29
PID 3004 wrote to memory of 3064	3004	bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" 4322987.ime,myInitIme C:\Users\Admin\AppData\Local\Temp\bab06d1595599bc4a04959804a743bab_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\4322987.ime

Filesize
7KB

MD5
0047b041b1e538eac863fdfee4ab64f9

SHA1
f43d882ee69c25f4d7212a9c780c1a04c9a0ba4a

SHA256
57022d4627cd05d7073d1cc4ce78767a2d7331e58742b7edd92ab37027353c93

SHA512
55fb9eb1fe03ea345d7e9b8877a5f3ff584da5addb4fef0f8b5b8ff8990faf1f2ef5fb238865b5123e131d8786ec85f840ded370a56c69b53ace349fdcff4ec5

Download Submit
\Windows\SysWOW64\qrd.dll

Filesize
7KB

MD5
9e3117b68c03262e10eb7f283e1a860e

SHA1
2f558d6ebabfdf8cefa4b7ce66c0a269fdd8c706

SHA256
190207a6edfa3930de871c8e6e5a0fdf531542ffd037d63ff5626d773a61a15c

SHA512
5cb02b03a58a4a07e1da2e4b1597803b28ac2c9e8c6f9f8b5a65989660d99504f63a0b128feb4c6bbc5dea1643456a02538d5a0616bd95c7b99f753f9cf16f93

Download Submit
memory/3004-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3004-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3064-11-0x0000000000150000-0x0000000000159000-memory.dmp

Filesize
36KB

Download
memory/3064-12-0x0000000000150000-0x0000000000159000-memory.dmp

Filesize
36KB

Download
memory/3064-8-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing