e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994

General

Target

bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
Size

108KB
MD5

bbf623d9290d3978cded5be9afe6de3a
SHA1

d59cadcc8ef8cb8f9d67e402c698872f0425153f
SHA256

e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994
SHA512

2808bb3b5323a93443f522bbec385228e9a34a1b4430b75560a80b33a9054e111903e44f8816545e649b63e8d9ff9ebbc41862b4905268708aa0b42f6a8ba832
SSDEEP

3072:S01G98h0qXYvDNL4KQkL2OsINxhc5bZHhsVMh:ZPJYrNL1Qk7Nc5bnh

Score

10^/10

credential_access discovery evasion spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	715088.exe

Executes dropped EXE 2 IoCs

pid	Process
2228	715088.exe
2948	715088.exe

Loads dropped DLL 2 IoCs

pid	Process
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2300-0-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/files/0x002d00000001956c-9.dat	upx
behavioral1/memory/2228-18-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/memory/2948-26-0x0000000000400000-0x0000000000561000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	715088.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index[1].htm	715088.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\web\result.dark	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
File created	C:\Windows\web\ddid	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
File created	C:\Windows\web\ddnm	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
File created	C:\Windows\web\ddsn	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
File created	C:\Windows\system\715088.exe	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
File opened for modification	C:\Windows\system\715088.exe	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	715088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E762BC63-5BFA-4244-BFED-7BB45B67224D}\WpadDecision = "0"	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E762BC63-5BFA-4244-BFED-7BB45B67224D}\06-f9-cf-cd-77-c8	715088.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-f9-cf-cd-77-c8\WpadDecisionTime = f0a81c1162f5da01	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	715088.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	715088.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	715088.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E762BC63-5BFA-4244-BFED-7BB45B67224D}\WpadDecisionReason = "1"	715088.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E762BC63-5BFA-4244-BFED-7BB45B67224D}\WpadDecisionTime = f0a81c1162f5da01	715088.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E762BC63-5BFA-4244-BFED-7BB45B67224D}\WpadNetworkName = "Network 3"	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-f9-cf-cd-77-c8\WpadDecisionReason = "1"	715088.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-f9-cf-cd-77-c8\WpadDecision = "0"	715088.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	715088.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f011a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E762BC63-5BFA-4244-BFED-7BB45B67224D}	715088.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-f9-cf-cd-77-c8	715088.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2228	2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2228	2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2228	2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2228	2300	bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system\715088.exe
  "C:\Windows\system\715088.exe" /start
  2⤵
  - Executes dropped EXE
  PID:2228

C:\Windows\system\715088.exe
C:\Windows\system\715088.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\web\ddid

Filesize
6B

MD5
e75b08f0d677b3ef0529a0155226cd08

SHA1
5de7c9b224bcc67ef76cf0b36acc75e1b36ee7c6

SHA256
963a10d3ff62c00bfbaeea29186160fd40f5935dee2a5efa7aa46129530d1548

SHA512
fa202c912002aa48e1892cdfb9b62f767501bfc642bf08b1e14c3eab755c4b1689310068cc073fd066633510f7a3e04e2f75935e21b725c71e8791bdcd91ce2f

Download Submit
C:\Windows\web\ddnm

Filesize
10B

MD5
441d58b3ebe63c10c22729ead5caf7aa

SHA1
8fbf8c42d7df9ab740645d245e1b23b1f0c48b87

SHA256
cdd067497eeb857400af41f2e448d161752458903512c9050da8232bb9b53013

SHA512
414e2f1c6ec6e6ca70beb4c07c7501cf5cbdd7b64f598fea785450605b88b7c578fe1efa262bbb5c6e2ab783ec2d37105939ee8e3b691181725834fe34eb44f4

Download Submit
C:\Windows\web\ddsn

Filesize
5B

MD5
0a8ddaad1c78d73b557663e728653f32

SHA1
cdd1be8014c739ee9eda16d16a0fd81a0b7ab6de

SHA256
9a1827d1c058dbd0d02109c5f11d6fd78ca942ae6ce1c2c5b16bf3acc8f91369

SHA512
f1aaa24b0d6ee52e2eaa6322dca32636a5ad377e819962d96da9b9d8d961f2f038048de11e288ca58191efa104e62cfb11949c9fe54bb9002c19de2d5d79a690

Download Submit
C:\Windows\web\result.dark

Filesize
32B

MD5
bb20a835bd1210468af8014aa6a022cd

SHA1
f3a93f807ff651d1b2ca1efb65a258de036a9fb4

SHA256
5f0f9de4feeb753b9c4bef8cb56070a3b681d8129f19e3874e39e99a105dd152

SHA512
1aa2e4b9185a68e3d1260c2189e49b9a16cf20fbc53260d974d2857728ff9b1d2a755a74df86d57e40850e157e6e13020898daa719c19b50e376fc5ec5cf7d98

Download Submit
\Windows\system\715088.exe

Filesize
108KB

MD5
bbf623d9290d3978cded5be9afe6de3a

SHA1
d59cadcc8ef8cb8f9d67e402c698872f0425153f

SHA256
e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994

SHA512
2808bb3b5323a93443f522bbec385228e9a34a1b4430b75560a80b33a9054e111903e44f8816545e649b63e8d9ff9ebbc41862b4905268708aa0b42f6a8ba832

Download Submit
memory/2228-29-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2228-18-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2228-23-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2228-24-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2300-16-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2300-6-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2300-0-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2300-5-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2300-30-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2948-26-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2948-27-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2948-33-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2948-34-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads