219913642293596bcea856cb1a9aa969cfed65fbb5ae408c40f479461ba35b60

General

Target

bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe
Size

50KB
MD5

bf3cb26536cefc1b3643320d89631d88
SHA1

04fe819eee5e3ff66c52c4514263644886c6a59f
SHA256

219913642293596bcea856cb1a9aa969cfed65fbb5ae408c40f479461ba35b60
SHA512

0f2c16ca55c8b278fdecb6123b80f5c527285f5b3744f2322fb7ff10505e4c452b5ff18a18234878e729323756b77c2f6bb07ab0c790b58a4aa69cc823df604f
SSDEEP

1536:hLvB1aPLFh7VMJyrEGPw9ERRpItzsWRoe7Akhlf3c:hLpry/o9ER7ItoWNjlf3c

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2816	regsrv64.exe
2376	regsrv64.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3716-0-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/memory/3716-7-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/files/0x000300000002327a-10.dat	upx
behavioral2/memory/2816-23-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft DLL Registration = "C:\\Users\\Admin\\AppData\\Roaming\\regsrv64.exe"	regsrv64.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3716 set thread context of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 2816 set thread context of 2376	2816	regsrv64.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsrv64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe
2816	regsrv64.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 3716 wrote to memory of 4748	3716	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	87
PID 4748 wrote to memory of 2816	4748	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	88
PID 4748 wrote to memory of 2816	4748	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	88
PID 4748 wrote to memory of 2816	4748	bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe	88
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91
PID 2816 wrote to memory of 2376	2816	regsrv64.exe	91

C:\Users\Admin\AppData\Local\Temp\bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bf3cb26536cefc1b3643320d89631d88_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Roaming\regsrv64.exe
    "C:\Users\Admin\AppData\Roaming\regsrv64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Roaming\regsrv64.exe
      "C:\Users\Admin\AppData\Roaming\regsrv64.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\regsrv64.exe

Filesize
50KB

MD5
bf3cb26536cefc1b3643320d89631d88

SHA1
04fe819eee5e3ff66c52c4514263644886c6a59f

SHA256
219913642293596bcea856cb1a9aa969cfed65fbb5ae408c40f479461ba35b60

SHA512
0f2c16ca55c8b278fdecb6123b80f5c527285f5b3744f2322fb7ff10505e4c452b5ff18a18234878e729323756b77c2f6bb07ab0c790b58a4aa69cc823df604f

Download Submit
memory/2376-21-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2816-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3716-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3716-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4748-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4748-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads