e8ac0bd743d6977945ee7d54a29a121e85a17ea46780923ad92e48813aa24177

General

Target

d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe
Size

886KB
MD5

d7bef10b8d8ef4c71a204cd3b5cde6e1
SHA1

36b7868685d590a25f07550ffa4dc0bcd8549ec3
SHA256

e8ac0bd743d6977945ee7d54a29a121e85a17ea46780923ad92e48813aa24177
SHA512

3df7265ade66b0c1cf1f4bd8762581130845e37afd6a4b26f138cd43f5980c3e7afbae30e89844520e4af473f9f64d142cbf9c0763ade0b4dd4c8dd4c5eb311d
SSDEEP

24576:jBXu9HGaVHThJZytlb3ndnyqChIK8z4E3SgW:jw9VH/glLhCr67/

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jfwwrpdtwmbtkaw.fr.url	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2092-0-0x0000000000EC0000-0x00000000010A7000-memory.dmp	upx
behavioral1/memory/2092-19-0x0000000000EC0000-0x00000000010A7000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2092-19-0x0000000000EC0000-0x00000000010A7000-memory.dmp	autoit_exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2092	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe
2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe
2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe
2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe
2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2080	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	30
PID 2092 wrote to memory of 2800	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2800	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2800	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	31
PID 2092 wrote to memory of 2800	2092	d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d7bef10b8d8ef4c71a204cd3b5cde6e1_JaffaCakes118.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 312
  2⤵
  - Program crash
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xsuswize

Filesize
321KB

MD5
24bee3d5d8dc4572d7ee704d2ce43c54

SHA1
58cf131c0fe411aa13f70156575ee91df619e271

SHA256
fece2d42640390398b95d24e60dfb02b6167e371a81560685d4e7d4c6da8270f

SHA512
59714c6a4712d88d47c6bc2595f22697bc2370c269ab08ce02d1b5e28dce56e9091179e913070393505e2269edc67823a5744e852b6b7db3c0945af0453807a0

Download Submit
memory/2092-0-0x0000000000EC0000-0x00000000010A7000-memory.dmp

Filesize
1.9MB

Download
memory/2092-12-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2092-13-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2092-14-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2092-18-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2092-17-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2092-16-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2092-15-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2092-19-0x0000000000EC0000-0x00000000010A7000-memory.dmp

Filesize
1.9MB

Download
memory/2092-20-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2092-21-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing