ddaa9f1e4d09add675e24eccf39deebc727aa9f45694ddef12aebe7b13ccd8ef

General

Target

eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe
Size

42KB
MD5

eabd019ce78357ace1d2316a36397054
SHA1

89c13864ae5f6fcc6d44149fa91affda7a97c45a
SHA256

ddaa9f1e4d09add675e24eccf39deebc727aa9f45694ddef12aebe7b13ccd8ef
SHA512

6d3d99b1a7fca1f5ad5c11ec9982d8af8a86ee1cef00c80bd6134ac3ef0b2014ac3a0e32b4587ab2592860a2f4950ac938c032fd6d7587c8b7c689c69b2ca871
SSDEEP

768:NzdmXnsMXl5H0j84tsKTidJb8nMLGypq/W2fHv8hUkKDukCul3hcpJZPYJoE0k:NoXEj86sKs8nMXq/pfBkKDudQmp2

Score

7^/10

defense_evasion discovery persistence privilege_escalation upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000233a7-8.dat	acprotect

Deletes itself 1 IoCs

pid	Process
3372	638C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3372	638C.tmp

Loads dropped DLL 2 IoCs

pid	Process
4172	rundll32.exe
3588	rundll32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000233a7-8.dat	upx
behavioral2/memory/4172-10-0x0000000010000000-0x000000001001C000-memory.dmp	upx
behavioral2/memory/3588-16-0x0000000010000000-0x000000001001C000-memory.dmp	upx
behavioral2/memory/4172-17-0x0000000010000000-0x000000001001C000-memory.dmp	upx
behavioral2/memory/3588-20-0x0000000010000000-0x000000001001C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\360Update = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\360data\\foxgeve.dll\",_RunAs@16"	rundll32.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3588	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	638C.tmp

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "C:\\Users\\Admin\\AppData\\Local\\360data\\73fa1286.z,1341477088,-1038824287,-1814625877"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3372	5048	eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe	82
PID 5048 wrote to memory of 3372	5048	eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe	82
PID 5048 wrote to memory of 3372	5048	eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe	82
PID 3372 wrote to memory of 4172	3372	638C.tmp	83
PID 3372 wrote to memory of 4172	3372	638C.tmp	83
PID 3372 wrote to memory of 4172	3372	638C.tmp	83
PID 4172 wrote to memory of 3588	4172	rundll32.exe	86
PID 4172 wrote to memory of 3588	4172	rundll32.exe	86
PID 4172 wrote to memory of 3588	4172	rundll32.exe	86

C:\Users\Admin\AppData\Local\Temp\eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\638C.tmp
  "C:\Users\Admin\AppData\Local\Temp\638C.tmp" "C:\Users\Admin\AppData\Local\Temp\eabd019ce78357ace1d2316a36397054_JaffaCakes118.exe" "5048"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 shell32,Control_RunDLL "C:\Users\Admin\AppData\Local\360data\73fa1286.z"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 "C:\Users\Admin\AppData\Local\360data\foxgeve.dll",_RunAs@16
      4⤵
      Loads dropped DLL
      Access Token Manipulation: Create Process with Token
      System Location Discovery: System Language Discovery
      PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Access Token Manipulation

1

T1134

Create Process with Token

1

T1134.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Access Token Manipulation

1

T1134

Create Process with Token

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\360data\73fa1286.z

Filesize
36KB

MD5
6c57e49f5d5640d3825152af4e5f9764

SHA1
5ce6770baf8fce7b6e8e01e3324a1012c3b622d3

SHA256
65fcdef04083bfcc7f322e127ebf1f7c75d6bccb126e50a9b28529712a5ee282

SHA512
cab03fa664ffb48d268f32cc64c7c6507d51b42f460b0e08a79dd6d52361b75eb2edcbfd28ca1df08e360ffc2a14f0e991febee23e3df4093584b45f7889eeeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\638C.tmp

Filesize
42KB

MD5
eabd019ce78357ace1d2316a36397054

SHA1
89c13864ae5f6fcc6d44149fa91affda7a97c45a

SHA256
ddaa9f1e4d09add675e24eccf39deebc727aa9f45694ddef12aebe7b13ccd8ef

SHA512
6d3d99b1a7fca1f5ad5c11ec9982d8af8a86ee1cef00c80bd6134ac3ef0b2014ac3a0e32b4587ab2592860a2f4950ac938c032fd6d7587c8b7c689c69b2ca871

Download Submit
memory/3372-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3588-16-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3588-20-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4172-10-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4172-17-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/5048-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5048-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads