5d213fdb4a6fcf3b78ee2bacd5be9761d7930cfc4469ce9bdf3f42be422d45a0

General

Target

eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe
Size

2.5MB
MD5

eb4ea339807a8e2dc47dc5011cb7d29a
SHA1

9e7ca690dd49272de65ff7df2aff7145b74e99f9
SHA256

5d213fdb4a6fcf3b78ee2bacd5be9761d7930cfc4469ce9bdf3f42be422d45a0
SHA512

9207cfea929089a823485109e83a22134eaeab2b630d461c34d53ec88622b11cc72486a4678033ca7d75dae311a5c7a140b16431a1514dddb52e77da94678e49
SSDEEP

49152:5LOd2M4AMvcfLOJeFykTyNXYNpKRAq983+qr:5LU2M4A0zFbXipoAF+4

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000186a9-10.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2736	eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2736-0-0x0000000000400000-0x00000000005A7000-memory.dmp	upx
behavioral1/files/0x00060000000186a9-10.dat	upx
behavioral1/memory/2736-15-0x00000000024D0000-0x000000000252B000-memory.dmp	upx
behavioral1/memory/2736-67-0x00000000024D0000-0x000000000252B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2736	eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe
2736	eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe
2736	eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb4ea339807a8e2dc47dc5011cb7d29a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~zm_{A0A58391-080C-4FD4-9BF0-2C4B9358E99F}\css\style.css

Filesize
2KB

MD5
7757619b8df51d677c79395a84e0c539

SHA1
8fa1685f830da61a0f4bbdb1db428f4dbef9c971

SHA256
7c8000bdae47f22b1db799db5e583902737de0fe37bf2581b18bedb63155b1a3

SHA512
3b779b7e4694bf11600b802ea690871f7e65f880c56b5b76fbb0ceede64feee143f6d23031dc485510cb496dad89705999f2e66d4df2390ca318570ff6c7d731

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{A0A58391-080C-4FD4-9BF0-2C4B9358E99F}\images\cellar_bg.jpg

Filesize
548B

MD5
4777779f71fde6d16f6cc99013c8daff

SHA1
312f97b25bd743a8a8d2268bdfd1ac53701345c2

SHA256
46e860286f1f016711f9e6a8b36335ba549c58aadd67322dae897c0f83c06cd2

SHA512
1b4cc3e5613c6bef54b47d23a53315f802a016d5961b81b4eab4012c8da1045fae3af486c97e281f9829d83f9190af29e685be2b3bf3ebc89cbbf0d4fcf5e775

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{A0A58391-080C-4FD4-9BF0-2C4B9358E99F}\images\index_top.jpg

Filesize
26KB

MD5
05c3582a4efb14334262dec9320b8ac3

SHA1
0c6d42c0f417c05ae285327b49002474021e4703

SHA256
48f5f24c3b2b24c244cf7211dd9804557436d6e617d9891e308934f32c2301c1

SHA512
f4532bf0d0676f64dd114139a86049c093c61c3926a929a2652d7f7d724dcb7505c03bbac3687c7a56f313359d5022137ffa25035d69cf2f91a745f867a124d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\~zm_{A0A58391-080C-4FD4-9BF0-2C4B9358E99F}\page.html

Filesize
1KB

MD5
63bda422255bddd5de716c9a4a513aec

SHA1
c12eb4c83d29e26f66a968238f22f55e8db9d8e3

SHA256
a44363f32306fd0df3818f3069d3ee803bc2e2b2fd14bdb88ba2071c9aea7a05

SHA512
bd5c1e349e8e23de8268e60df7b40df3207a5832cd15da89974edeccb8b3b2db34d2d68effbe3aa8327b51dbace433ff58755610e48ba0806dd416311d64a658

Download Submit
\Users\Admin\AppData\Local\Temp\{353DF52F-24D5-4663-B71F-70C8BEC19213}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
memory/2736-15-0x00000000024D0000-0x000000000252B000-memory.dmp

Filesize
364KB

Download
memory/2736-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2736-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2736-3-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2736-0-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2736-64-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/2736-66-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2736-67-0x00000000024D0000-0x000000000252B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing