85429d8da41e63afb3cb8f163c57d6381491bd31856fdf4be9c0affc5dce5ff8

General

Target

c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
Size

70KB
MD5

c20bc6be3a35119c43fb89eed45efabb
SHA1

fa079f629b8f4cc82562d98e27c813f9347fd3f5
SHA256

85429d8da41e63afb3cb8f163c57d6381491bd31856fdf4be9c0affc5dce5ff8
SHA512

e8035692c4e9a89611401bc92bf361500dbcbba415efb50c370064b4226c87860f3184a42d50ea58646e6c6e32fe1caf91855d78302e8c3b18d37d722a35c224
SSDEEP

1536:P/1W/TQq8+8gnIJZij2zqeHyxBxBBHTBpiuSNTtkpXUJSVF:PdmI+FjAHyxBxbHTBsuSYXUcF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	lsssass.exe

Loads dropped DLL 2 IoCs

pid	Process
1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1824-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x0008000000016d32-5.dat	upx
behavioral1/memory/2704-12-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1824-17-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-27-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-28-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-39-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-50-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-93-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-104-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-115-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-126-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-137-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2704-159-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsssass = "C:\\Users\\Admin\\AppData\\Roaming\\Dir\\lsssass.exe"	lsssass.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsssass.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
2704	lsssass.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
2704	lsssass.exe
2704	lsssass.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2704	1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2704	1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2704	1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe	30
PID 1824 wrote to memory of 2704	1824	c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c20bc6be3a35119c43fb89eed45efabb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Roaming\Dir\lsssass.exe
  C:\Users\Admin\AppData\Roaming\Dir\lsssass.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Dir\Dated.dat

Filesize
4B

MD5
cb492b7df9b5c170d7c87527940eff3b

SHA1
66928e6cbb59c3a3bce606959ef4a865fe04e642

SHA256
dba5166ad9db9ba648c1032ebbd34dcd0d085b50023b839ef5c68ca1db93a563

SHA512
ce677db6ae33c5496874a2902d30d361f6cf12576e96bd8a9f6626a0ca29f0b4f97e403e54711d24ebf34d4e183235a8f9951345d32a20f2dad476d911ee7e06

Download Submit
\Users\Admin\AppData\Roaming\Dir\lsssass.exe

Filesize
70KB

MD5
c20bc6be3a35119c43fb89eed45efabb

SHA1
fa079f629b8f4cc82562d98e27c813f9347fd3f5

SHA256
85429d8da41e63afb3cb8f163c57d6381491bd31856fdf4be9c0affc5dce5ff8

SHA512
e8035692c4e9a89611401bc92bf361500dbcbba415efb50c370064b4226c87860f3184a42d50ea58646e6c6e32fe1caf91855d78302e8c3b18d37d722a35c224

Download Submit
memory/1824-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1824-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-27-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-39-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-50-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-93-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-104-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-115-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-126-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-137-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2704-159-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads