f93d837cfe5b4bf9e6cd84262588063637df292c10751571e98af666bf0f42c0

General

Target

dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
Size

1.0MB
MD5

dabffccdfdade7a4593ccaec16369180
SHA1

cd32d1a177c8f22a04d17732e9ab7e751eb1e18a
SHA256

f93d837cfe5b4bf9e6cd84262588063637df292c10751571e98af666bf0f42c0
SHA512

eb50319053af0776b6b1ca0115596f2df20ac8c5128a29dc4401e886995b3f0e4b28efe7392940771674cf47957c8eb9980227e46a5a6a47a2b5811163ad4165
SSDEEP

24576:WTZqBtXggzgTA6kEBSDz9h3cOrXUVOAL7BTQHUY:WcxLfVDLLCxxY

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000120ce-2.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1972	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000120ce-2.dat	upx
behavioral1/memory/1972-4-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-13-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-12-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-11-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-10-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-9-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-8-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-7-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-14-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-15-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-16-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-17-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-18-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-19-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-20-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-21-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-22-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-23-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-24-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-25-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-26-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-27-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-28-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-29-0x0000000010000000-0x0000000010043000-memory.dmp	upx
behavioral1/memory/1972-30-0x0000000010000000-0x0000000010043000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\system\Skin.dll	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
File created	C:\WINDOWS\system\QQ2009.she	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1972	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
1972	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
1972	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
1972	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
1972	dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dabffccdfdade7a4593ccaec16369180_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\system\Skin.dll

Filesize
98KB

MD5
4e70aa97f22995853da109a2a05b1335

SHA1
16d243efe827436907a65aeafcd02312960225a0

SHA256
ee59d2fd30511ce7611a4a229610584a52678d9423f41c23e2aaae56b211bd4f

SHA512
1aed4011fcbb0eabc14d236d0aea4b54e33d02365777196ceb22d84aaf4de7469bda0f5d124bd022c3c1c3748cd6467008cef0de1f0f025e7a324fbc7152854e

Download Submit
memory/1972-4-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-13-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-12-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-11-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-10-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-9-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-8-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-7-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-5-0x000000001000A000-0x000000001000B000-memory.dmp

Filesize
4KB

Download
memory/1972-14-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-15-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-16-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-17-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-18-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-19-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-20-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-21-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-22-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-23-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-24-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-25-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-26-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-27-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-28-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-29-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1972-30-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing