19507f30f5a691c16e97626afd6528d420d827bd7e94d525a712f591fabe60d4

General

Target

d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
Size

756KB
MD5

d2d0dc5993532316b1a39ef53ff03f0b
SHA1

4b956bef0f3807f7ea5cb140b93b5b7088ed1f1c
SHA256

19507f30f5a691c16e97626afd6528d420d827bd7e94d525a712f591fabe60d4
SHA512

6868f5823627b94c35147f4d95dcc45b9fbb1edb6aaecde522dba914a8bac7affc4968658a05d702c1c03c68c6cde14dcb08a068efd486a2f0d176ddf00c1564
SSDEEP

12288:tVepajkAGKIHZW2yBFGnk7d5qddMWFvW2LPp1tFChspvmtREjCT8:2zOyIFG+5qddDhH3oVLEjCT8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
5052	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
5052	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
5052	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
5052	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
5052	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
5052	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2000-0-0x0000000000400000-0x00000000005F2000-memory.dmp	upx
behavioral2/memory/1760-3-0x0000000000400000-0x00000000005F2000-memory.dmp	upx
behavioral2/memory/5052-2-0x0000000000400000-0x00000000005F2000-memory.dmp	upx
behavioral2/memory/5052-35-0x0000000000400000-0x00000000005F2000-memory.dmp	upx
behavioral2/memory/2000-37-0x0000000000400000-0x00000000005F2000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1760	2000	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe	83
PID 2000 wrote to memory of 1760	2000	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe	83
PID 2000 wrote to memory of 1760	2000	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe	83
PID 1760 wrote to memory of 5052	1760	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe	84
PID 1760 wrote to memory of 5052	1760	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe	84
PID 1760 wrote to memory of 5052	1760	d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d2d0dc5993532316b1a39ef53ff03f0b_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\v4sx8xE6aANRDwhtIjK\1yeWDF4rU.dll

Filesize
74KB

MD5
727216a3430f46b6e4a154784e32cf7f

SHA1
a4424006237bd64bb57ae5867b77883c216e43a2

SHA256
b00fb2d7e9a786ecb46b57ddc8c216135ac296c80844f4a97577d532f7a05a05

SHA512
bc7a3498a3410e10f0d0a6a79b9958cd2e814426dd29ebc9735aa9ac0a0d93102f8d4c84a53314b442065185fd15393373be1f6e689e37fea0e7526fda383608

Download Submit
C:\Users\Admin\AppData\Local\Temp\v4sx8xE6aANRDwhtIjK\2WpJcOpwJZ.dll

Filesize
200KB

MD5
f81289b5936bebef64a0d143262f6028

SHA1
cf472fd32ec4e9cc0a5f7c70c762764d1d88875a

SHA256
e0d5b71faae38634922fcb488bcc2778c67f7169c02e974c2e6681f27a5c2338

SHA512
82975edee7ce51b662ec6120c647aa4f0998e58ca6a1bf0ede0457e0d5d60023c12a668d8704a1044af3bf30b97d3ae8c1563855fa67de8e18a8ef354e61d355

Download Submit
C:\Users\Admin\AppData\Local\Temp\v4sx8xE6aANRDwhtIjK\lua51.dll

Filesize
494KB

MD5
f0c59526f8186eadaf2171b8fd2967c1

SHA1
8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

SHA256
6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

SHA512
dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

Download Submit
C:\Users\Admin\AppData\Local\Temp\v4sx8xE6aANRDwhtIjK\yZvWSsXxcDUukLwXNnrSdEbC90vWFf90iJ.dll

Filesize
5KB

MD5
44dac7f87bdf94d553f8d2cf073d605d

SHA1
21bf5d714b9fcab32ba40ff7d36e48c378b67a06

SHA256
0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

SHA512
92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

Download Submit
memory/1760-3-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2000-37-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2000-0-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/5052-11-0x00000000006B0000-0x00000000006C7000-memory.dmp

Filesize
92KB

Download
memory/5052-26-0x000000007FE30000-0x000000007FE40000-memory.dmp

Filesize
64KB

Download
memory/5052-24-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/5052-23-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/5052-22-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/5052-25-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/5052-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/5052-18-0x00000000006D0000-0x0000000000706000-memory.dmp

Filesize
216KB

Download
memory/5052-30-0x000000007FE40000-0x000000007FE50000-memory.dmp

Filesize
64KB

Download
memory/5052-35-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/5052-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing