0cd3dd68e24b1eaefd656aec5f90d94e79955e61fd1e90e13594d2413e6a135b

General

Target

d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
Size

1.4MB
MD5

d9d02fc8a49a364b07e681e6848d1bde
SHA1

e6f3f91045436f04c9c13518de86c05ef14061b5
SHA256

0cd3dd68e24b1eaefd656aec5f90d94e79955e61fd1e90e13594d2413e6a135b
SHA512

1e22ee984404efed8b9d931fcd43b97ca8dee88b4cfbc9c0440f7abe0fc23ee9c61b6c8179c2247ce3ffcaa3819d70298957b04b8d552b7dc2952ca3602848f7
SSDEEP

24576:IVnjN6MGHv+2xIuY3rfBmKU4vJTxq5MM2d6LNXV0PtGap75qsQb0XwV:IVnB6XP+2xIuYtmKb1x82d6LT0FGa7CV

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3424-0-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3424-14-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3424-54-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3424-135-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mpkmgvw.exe	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shell\play\command\ = "\"C:\\Windows\\system32\\mpkmgvw.exe\" \"%1\""	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shell\play\command	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shell	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mp3file\shell\play	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2540	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	4696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4696	AUDIODG.EXE
Token: 33	2540	vlc.exe
Token: SeIncBasePriorityPrivilege	2540	vlc.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2540	vlc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2540	3424	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe	85
PID 3424 wrote to memory of 2540	3424	d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe.wma"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ren *.mp3 *.exe
  2⤵
  PID:432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d9d02fc8a49a364b07e681e6848d1bde_JaffaCakes118.exe.wma

Filesize
1.4MB

MD5
797bf9dbcc64c9e106a5b6eb948a5fc5

SHA1
2f7f60feec948cb2d822f5c8ba51a21e09976fb2

SHA256
5d6dcd5184098a56473312e797943390be25b1c0cc0408a77dc6fefc89e37ee4

SHA512
7db27257eb587d8af27978837a046fcef8e0add66e82e4299e37e90f40d324fb540a273774ecd9e7f9d44e6ee6307a2f00b777565eb6a1af588d95e59ab49902

Download Submit
memory/2540-20-0x00007FFA0FB70000-0x00007FFA0FB81000-memory.dmp

Filesize
68KB

Download
memory/2540-27-0x00007FF9FA170000-0x00007FF9FB220000-memory.dmp

Filesize
16.7MB

Download
memory/2540-15-0x00007FF68F440000-0x00007FF68F538000-memory.dmp

Filesize
992KB

Download
memory/2540-16-0x00007FFA0E240000-0x00007FFA0E274000-memory.dmp

Filesize
208KB

Download
memory/2540-24-0x00007FFA0AE80000-0x00007FFA0AE91000-memory.dmp

Filesize
68KB

Download
memory/2540-21-0x00007FFA0E150000-0x00007FFA0E167000-memory.dmp

Filesize
92KB

Download
memory/2540-25-0x00007FF9FB570000-0x00007FF9FB77B000-memory.dmp

Filesize
2.0MB

Download
memory/2540-26-0x00007FFA0AB80000-0x00007FFA0ABC1000-memory.dmp

Filesize
260KB

Download
memory/2540-23-0x00007FFA0AEA0000-0x00007FFA0AEBD000-memory.dmp

Filesize
116KB

Download
memory/2540-22-0x00007FFA0AF80000-0x00007FFA0AF91000-memory.dmp

Filesize
68KB

Download
memory/2540-19-0x00007FFA10D90000-0x00007FFA10DA7000-memory.dmp

Filesize
92KB

Download
memory/2540-67-0x00007FF9FA170000-0x00007FF9FB220000-memory.dmp

Filesize
16.7MB

Download
memory/2540-32-0x00007FFA0A8B0000-0x00007FFA0A8C1000-memory.dmp

Filesize
68KB

Download
memory/2540-17-0x00007FF9FB970000-0x00007FF9FBC26000-memory.dmp

Filesize
2.7MB

Download
memory/2540-18-0x00007FFA128D0000-0x00007FFA128E8000-memory.dmp

Filesize
96KB

Download
memory/2540-33-0x00007FF9F9F10000-0x00007FF9FA163000-memory.dmp

Filesize
2.3MB

Download
memory/2540-28-0x00007FFA0AE50000-0x00007FFA0AE71000-memory.dmp

Filesize
132KB

Download
memory/2540-31-0x00007FFA0AB20000-0x00007FFA0AB31000-memory.dmp

Filesize
68KB

Download
memory/2540-30-0x00007FFA0AB40000-0x00007FFA0AB51000-memory.dmp

Filesize
68KB

Download
memory/2540-29-0x00007FFA0AB60000-0x00007FFA0AB78000-memory.dmp

Filesize
96KB

Download
memory/3424-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3424-135-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing