fc70a35fc14bb339d472acdacfe886b8a37c75325a81cf0c4b28326f2b625f3a

General

Target

c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe
Size

121KB
MD5

c9424c4b6057d6c7a6d694762e3c6dd2
SHA1

9fd549e618d6d726234dad7e66053bf957518708
SHA256

fc70a35fc14bb339d472acdacfe886b8a37c75325a81cf0c4b28326f2b625f3a
SHA512

3f487c85bb2466b135fcb8604d1101cedad8e0f3097c3d96ba03151a0f17d9e9392d27b2be5565b0ef82ec12aac7f3c5f430a995fd945570e5f8f62b75f1de4d
SSDEEP

3072:teSQ41MZrrOwzrq5Ss9eYfphfFQkUcot3EpeBWLs+gozFrQ:tVYrJrOSsRwcplgoz1Q

Score

8^/10

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\62119EF862C6B3A0D853419B87EB3E2F6C78640A\Blob = 03000000010000001400000062119ef862c6b3a0d853419b87eb3e2f6c78640a2000000001000000df030000308203db30820344a00302010202033fc398300d06092a864886f70d01010405003055310b3009060355040613025a4131253023060355040a131c54686177746520436f6e73756c74696e67202850747929204c74642e311f301d0603550403131654686177746520436f6465205369676e696e67204341301e170d3035303831353031353134345a170d3037303931363133323531325a30818b310b3009060355040613024652310e300c0603550408130552686f6e65310d300b060355040713044c796f6e31193017060355040a1310656c656374726f6e69632d67726f757031273025060355040b131e536563757265204170706c69636174696f6e20446576656c6f706d656e743119301706035504031310656c656374726f6e69632d67726f757030820122300d06092a864886f70d01010105000382010f003082010a0282010100e2754d8a4e6d4db6e025b0073520ddd7eeec116a813940fda2c4c66f7a354adb3036188d4078f8891b3fe15d467dfba5e17984cac2b246c27c052e63956dfe817eb423b9615bddfddaadac5e2ac0f41f583edd24d7830f5875df2937a9152b741eef3950e5116e76d2e7e3ffdf6fcb5858af26f5e2effd019a1f82b98d7f21ed089d5bb8553cd89c823becaeb62ea1cc4b455cb4e93e8ac715320f31dc3fbc2d0be0d65c608c58c19ff06da7bc1ec48a45ef0219eef40294504e2663b1c9dad6a2241df996c59cf110b706285fbaeae0c55d776573536218c3c7ae248b82cae01513cd8b2828a94f4a70ba6e199919a0f5eae20643feaabebe2ba3b2819e92790203010001a381fd3081fa301f0603551d250418301606082b06010505070303060a2b060104018237020116301106096086480186f8420101040403020410301d0603551d0404163014300e300c060a2b0601040182370201160302078030230603551d11041c301a82187777772e656c656374726f6e69632d67726f75702e636f6d303e0603551d1f043730353033a031a02f862d687474703a2f2f63726c2e7468617774652e636f6d2f546861777465436f64655369676e696e6743412e63726c303206082b0601050507010104263024302206082b060105050730018616687474703a2f2f6f6373702e7468617774652e636f6d300c0603551d130101ff04023000300d06092a864886f70d01010405000381810075160a692f4bc2096bce67c58b0d88320552104e4d35f5018bc2ab1be03ecae3c0abe7db45629b1b3c1812039145c15d6f2774c211a2c86f93a819573d58a3c0e66d1e19e84638800e3372880b4e9cdcf70cc769bdeff236ed3ac6f20e370122fa791e71b0ea8be78077ffc288c382b201d78ea8bbf9e9457fad4ee80273279c	regedit.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002347d-23.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	iaccess32.exe

Executes dropped EXE 1 IoCs

pid	Process
3184	iaccess32.exe

Loads dropped DLL 1 IoCs

pid	Process
3984	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/940-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x000900000002340d-3.dat	upx
behavioral2/memory/3184-4-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/940-7-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x000700000002347d-23.dat	upx
behavioral2/memory/3984-25-0x0000000010000000-0x0000000010047000-memory.dmp	upx
behavioral2/memory/3184-53-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\egaccess4_1071.dll	iaccess32.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Instant Access\Multi\20110121030100\Common\module.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110121030100\dialerexe.ini	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Multi\20110121030100\dialerexe.ini	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NoCreditCard.lnk	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110121030100\medias\dialer.ico	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110121030100\js\js_api_dialer.php	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20110121030100\instant access.exe	iaccess32.exe
File created	C:\Program Files (x86)\Instant Access\Center\NoCreditCard.lnk	iaccess32.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NoCreditCard.lnk	iaccess32.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\iaccess32.exe	c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe
File created	C:\Windows\tmlpcert2007	iaccess32.exe
File created	C:\Windows\dialexe.zl	iaccess32.exe
File created	C:\Windows\dialexe.epk	iaccess32.exe
File created	C:\Windows\dialerexe.ini	iaccess32.exe
File created	C:\Windows\egdhtm_pack.epk	iaccess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaccess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\À	iaccess32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ = "C:\\Windows\\SysWow64\\egaccess4_1071.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{413E282B-C32A-4717-A0F3-4F2E6FE25F83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Runs regedit.exe 1 IoCs

pid	Process
1972	regedit.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
940	c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe
3184	iaccess32.exe
3184	iaccess32.exe
3184	iaccess32.exe
3184	iaccess32.exe
3184	iaccess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3184	940	c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe	84
PID 940 wrote to memory of 3184	940	c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe	84
PID 940 wrote to memory of 3184	940	c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe	84
PID 3184 wrote to memory of 1972	3184	iaccess32.exe	86
PID 3184 wrote to memory of 1972	3184	iaccess32.exe	86
PID 3184 wrote to memory of 1972	3184	iaccess32.exe	86
PID 3184 wrote to memory of 3984	3184	iaccess32.exe	87
PID 3184 wrote to memory of 3984	3184	iaccess32.exe	87
PID 3184 wrote to memory of 3984	3184	iaccess32.exe	87

C:\Users\Admin\AppData\Local\Temp\c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9424c4b6057d6c7a6d694762e3c6dd2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\iaccess32.exe
  C:\Windows\iaccess32.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s C:\Windows\tmlpcert2007
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:1972
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Windows\system32\egaccess4_1071.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Instant Access\DesktopIcons\NoCreditCard.lnk

Filesize
2KB

MD5
26ad116e8f41024f33fdc0ecf9697451

SHA1
cc7e3558789b7f129b9269943f067528baaf22ce

SHA256
f4687993f38cd77d9a33f7181609009c78b8f1d62a71460f85b54cabab3c4d43

SHA512
f8248085e123d92262154a61dbf3bb1a7774a15c27cf3ca45a10b52e0733f5cac0647e10132554b8c176bfc341bcf972dc223dafce71122d9c6b2f553cbfef1f

Download Submit
C:\Program Files (x86)\Instant Access\Multi\20110121030100\dialerexe.ini

Filesize
615B

MD5
ea98c8addb283312876437e555364143

SHA1
82e8c5513f9546d3cf408c670a60c74830367fb1

SHA256
ac0b59603c16ac25b582aa56bb504c28ff4b8b41d1dde8e11159631891b0b759

SHA512
e9cf9c0b493aa1f4ad1b71eb4a512233427dfac7fab4c823ce23bb4e9d55f5f43ba1bc97419b54d85641e736d50bf8b65ea58d4b81b51264e026ce9f18bd27bc

Download Submit
C:\Windows\SysWOW64\egaccess4_1071.dll

Filesize
76KB

MD5
b83f652ffa76451ae438954f89c02f62

SHA1
b3ba0014dd16cee5f6d4cfe7e28b2d5de79dc6dd

SHA256
f601991aa00cbe7001197affc0e3854ab76c51c05b9a6ca3e3f708fed876c32f

SHA512
965172a5ecd070ea6707ec9985ee3c135c06534561b90ae233e8049b247d87d529b8280f0faf2b0ed933f59c68844414726fa80c4d3119cffa4fdd1cb60eab83

Download Submit
C:\Windows\iaccess32.exe

Filesize
121KB

MD5
70b1f1c3710c884b57f4d1452760221c

SHA1
eb4ae74a1947e4d120dac25072bb94fc3888cc5d

SHA256
5dfb38205a5662723a2967ec2c85eeb5718ab0e531a8a95309ef1150c40b28f2

SHA512
cff95dd0337d90d2f6017a1ed72674cce73286537d36cd97a2ed368d5cc60f2355acf753586fefc947528c449970af192d4a72935aa950d287b39027904ee111

Download Submit
C:\Windows\tmlpcert2007

Filesize
6KB

MD5
b103757bc3c714123b5efa26ff96a915

SHA1
991d6694c71736b59b9486339be44ae5e2b66fef

SHA256
eef8937445f24c2bcbe101419be42694e0e38628653a755ab29ecba357d81d48

SHA512
d04f2ab14ad4d3e06ea357b4c810515d73b32f2650533a5895ebf5d14b4b697752f25c0c371372e00faab661c0b051c33b8c25bf1226f30be5d6b8727dea81e1

Download Submit
memory/940-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/940-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3184-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3184-53-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3984-25-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing