b85cc52afc3fcb4dc5f28491c8c1c937c739e65506a947f8d4c8790eec92acbf

General

Target

eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe
Size

76KB
MD5

eacbfef00ff334e406fd02958129e2dc
SHA1

0f118b8ed1eda0656279e8667550db2186531144
SHA256

b85cc52afc3fcb4dc5f28491c8c1c937c739e65506a947f8d4c8790eec92acbf
SHA512

f7779e0a38c880f987c9317b4850313c0d614fb6b829d0ff95aa070f1a3dc7a7b3272b8fe20102a077d4db77ff28602bde528d563b592868c66d51dbc84e14f9
SSDEEP

1536:LO3pRIHxyaURyBHkmCLG3RAO7pCaaE/0kn8DqBTW37BWm71Ue:K5RIHxUyBHoMDCa7cOugTW3dd1

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2160-0-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect
behavioral2/memory/2160-1-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect
behavioral2/memory/2160-5-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect
behavioral2/memory/3416-14-0x0000000000400000-0x0000000000423000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2844	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	explorer.exe
2844	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3508	2160	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe	82
PID 2160 wrote to memory of 3508	2160	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe	82
PID 2160 wrote to memory of 3508	2160	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe	82
PID 2160 wrote to memory of 3416	2160	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe	83
PID 2160 wrote to memory of 3416	2160	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe	83
PID 2160 wrote to memory of 3416	2160	eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eacbfef00ff334e406fd02958129e2dc_JaffaCakes118.exe HideOK
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\debug.txt

Filesize
42B

MD5
4412ee00d7924b87066bfef6e037c009

SHA1
7f590ad899bd28e5700514b76392f65d07337633

SHA256
d949bcf4d55c2f6319ce4f9ceb347d52f6d5867cdb1a64631a0fe0045e5603d0

SHA512
c255d17cd76126c7029928977c2835094e60fd08b8e24336b0dd178bc14e49d36f55bc598f622817a56a04482606502ecec1d6418e0b3fd494429e35177ff8c4

Download Submit
memory/2160-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2160-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2160-5-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3416-14-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing