d53c7d5ea9bb8e44e0d4d06794e8870e6f588a2db0bf00aa409ae1a2d45b9438

General

Target

bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe
Size

49KB
MD5

bf1fed9c0a93d5b8f5ee12275d97771a
SHA1

e8f73d679ae29e3125a622160820d0912065f0a2
SHA256

d53c7d5ea9bb8e44e0d4d06794e8870e6f588a2db0bf00aa409ae1a2d45b9438
SHA512

4b9ce2d3332294066bade7dc90d887928bf424a520bdbecbfab12513f640ebf0e3af5cdeaa81d66ff5940fd41d6cde895c60ca89b61f391c334e69e3209bab42
SSDEEP

768:7f9L5DuylOlZrcKOrQZ28lR0aHPNb/rIln:7t5DrkcPr2BlakFrIln

Score

10^/10

discovery evasion upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe:*:Enabled:ldrsoft"	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/464-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-1-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-2-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-5-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-7-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-9-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-11-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-13-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/464-16-0x0000000000400000-0x0000000000418000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3804	464	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe	107
PID 464 wrote to memory of 3804	464	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe	107
PID 464 wrote to memory of 3804	464	bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe	107

C:\Users\Admin\AppData\Local\Temp\bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf1fed9c0a93d5b8f5ee12275d97771a_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\BF1FED~1.EXE00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BF1FED~1.EXE00.bat

Filesize
192B

MD5
6a8513a72aaa829fef0c95676742ae1c

SHA1
ebfaf800bf10e6a9cf90ffcb06fe69c6b7028a7a

SHA256
98fc2b12801b85352a789c97f47f040a86b2b0cc3f6b620e3a905eb782c9307d

SHA512
cc3e1fecf6becf6e0b5e0d598ed542955a0795e9caab3f88efc2d38b8940ffcf930340e5ff6845b3e8cf1c5db69411483f6a309ac1cd7e183b7ac85f497054ff

Download Submit
memory/464-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-7-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-13-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/464-16-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads