27edc9b87a2a875807911a5e6b6c93d3707544b3528ea58446de6f395b8e954e

General

Target

ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe
Size

2.4MB
MD5

ddc5a073818a1ea3b2f6b30c30fe1210
SHA1

95eb1a212b436b2e9633fd79ebb52c97c909f047
SHA256

27edc9b87a2a875807911a5e6b6c93d3707544b3528ea58446de6f395b8e954e
SHA512

b7e8a34b7a09e6ae58351507ff2519b7c02e33f6018794cdbdca616816faa88a67eba88326987f378d2a1da77ef28bd94195b9fd70457a31abe9916ea7cfe39b
SSDEEP

49152:6h+IpWq4MQIRUZVJikiYOb5aD8yuQ0O+hd0W5E2ibtXbYm7MxvA3Bvl:6EIpr9UHyc8yunOSZ5JIeK1l

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4012	autorun.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023435-34.dat	upx
behavioral2/memory/4012-36-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-45-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-46-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-47-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-48-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-49-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-50-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-51-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-52-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-53-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-54-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-55-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-56-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-57-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-58-0x0000000000400000-0x0000000000711000-memory.dmp	upx
behavioral2/memory/4012-59-0x0000000000400000-0x0000000000711000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autorun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4012	autorun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2040	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3020	ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe
3020	ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe
4012	autorun.exe
4012	autorun.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4012	3020	ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe	84
PID 3020 wrote to memory of 4012	3020	ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe	84
PID 3020 wrote to memory of 4012	3020	ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe
  "C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\ddc5a073818a1ea3b2f6b30c30fe1210_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x384
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\scanbtn.btn

Filesize
1KB

MD5
1c47840019491d7ee6ff4a0cf771e5f3

SHA1
d6c903070c78ae35d1c98d86ac2bebc176aa4a3b

SHA256
74f2b0e67a84a857d51ef1bd4eae04e7360fb381ffc44eeb0565bf7fe1fbb458

SHA512
6663c860c47750d82943592b0f3b53229ccaad482462198bc7553d4b4b682e139327b9354b07615a7493670fba2dd3cbc2a501e015941843ebd0805c1eef4deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\3_2.png

Filesize
1KB

MD5
f8df9b6fcc0e49cc616b8ffbe4a129d1

SHA1
8b5c1895f0910946132d87eef4cc2ec331a2a5c0

SHA256
32521dd937f52814a51e8aea87b86bee1b7c4bdf64eb20d4d8bf7270bc33fcd9

SHA512
f78d655fe5566f2e89992119dca0b2e6e7d6da96fb95d7bebb3515a3806f5219011a2a69f7b1cd1d45b111e452aabff0891d2ea2f0fc2dc7f31e7390653667d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\exit.png

Filesize
1KB

MD5
421ed8d0981489463fc473d5c040447e

SHA1
42ecc574b5ed7c39641162b3e611d8321c57d7e2

SHA256
d14372c13c69f8b8abe31258b38befbfb8c12d3c261fbf92f9f3309d1c7ebcd8

SHA512
c3ad780b5470519e8b94365ba9414d56743525fd8a5a5623fed39ae8219e1c9c2dfcf331704ac6628cd09c140c69975c833d7fdd3d09e924279a178569e1747a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\parallels.png

Filesize
7KB

MD5
f002547583ffffe3bf6cf09951513584

SHA1
1f422c5089426691571d4c129a897c984f37ebde

SHA256
d067879edd050306f31d190188b750f0ce55ec1c942a79c17e518fc563bf856d

SHA512
f50b2e9f1f2964a7611d34cf07d4b98e108e58181812e24d88388015e2e458d4d8d5d0cab583054131f511a3bc71b018e41f9a7a2c0f573ff6342a6288bdfbac

Download Submit
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd

Filesize
953KB

MD5
974a602199a3ba898bab35d2679195b4

SHA1
c7db047c141ae6f163d2837f6329a8d574a8728c

SHA256
c007b0c8a1f54ea63ade82e8d0611adcd43080c69af7dfcf3ef2c59f5f4c1da8

SHA512
7a94061d67fa0f0ea46ddc4e3d7d8496ff0572d264d9dc5ab79a00b7991bd05446a8372c53559098376214a0c9201c74079bed3139d793b1f89121331eadd36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe

Filesize
1021KB

MD5
264b62e7dabd98410afd1904774f9f78

SHA1
876f3121ed62598499197c96dd77f40c1dd93f25

SHA256
045a4bd29603c46c9e97dd5a8ab6bdc016149736cb887e63f0d8f1f27e40c0a3

SHA512
fe24ce822f66daec8d92c465fbd9bfe53d6ffd4c9a82f20d3add2202c95ba0d4e72fc38b8a7061aa4fd877341067fa965e4c8967ac017406f0ffeafa4af03976

Download Submit
memory/4012-48-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-51-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-46-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-47-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-36-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-49-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-50-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-45-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-52-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-53-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-54-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-55-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-56-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-57-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-58-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4012-59-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing