226dccb2b48a26f5e1059e1c6da369986991f1532f625d5de7759a09b9d6fd3c

General

Target

ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe
Size

895KB
MD5

ee672d18981e368f5e7e168864f92f15
SHA1

bbd137e7f8d90992fbe3098ad3680058371334b6
SHA256

226dccb2b48a26f5e1059e1c6da369986991f1532f625d5de7759a09b9d6fd3c
SHA512

88be053e64078e61098892ba1de0815bb0b3cca1a7207bdd8f8c998504aa0a69093d55e37e671939dc7df76f27951304f4f94970b9beb3b0efbd4878130d2089
SSDEEP

24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFe:Kwi0L0qlFwi0L0qlGx

Score

10^/10

aspackv2 discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00090000000233ea-3.dat	aspack_v212_v242
behavioral2/files/0x0007000000023450-11.dat	aspack_v212_v242
behavioral2/files/0x0007000000023454-41.dat	aspack_v212_v242

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
2616	HelpMe.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	C:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe
3328	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2616	3328	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe	82
PID 3328 wrote to memory of 2616	3328	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe	82
PID 3328 wrote to memory of 2616	3328	ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee672d18981e368f5e7e168864f92f15_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.exe

Filesize
867KB

MD5
2c18d1967490a8ffabc8fba89e77dc13

SHA1
c24a36e320d48a7f213bf926fdd4a1287425f7a1

SHA256
1cb5ff8fb0865824942da2811b01f3e834c916d249f18dc6389161ac4ddfce44

SHA512
9d1a1e8ee90880dc760e99c7e9fa8f9e615305d093573f52f4f9d592911d6f961bcaeb46a7118489e7805a17b563da92b54d9162266209cee304019aea3f8716

Download Submit
C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe

Filesize
1.7MB

MD5
ab7666e1b83ea0a7b9e42b854bbbe5ec

SHA1
fc7d2e95e42ee311d22397774166a196dd97c986

SHA256
251c97de89f122c0fa4c0534a15a094e0b8b1d003d526e1b433a6357b62f5f76

SHA512
f8eae6ef994f90c823ad3452ef9cc891a20082888272a5e33f5b4503753e8bbe61cdf63c01b0b14adf8d71c5f643dafc990c7ed039a01afd314ad165ca668d2e

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
866KB

MD5
c378c77f977bf63d6a1b6d6ea8247bd3

SHA1
73053ce4027e3f530979e4f23f82e547520bd442

SHA256
610250bec271b8072d9f6b6a1373f413022dcb5b687336d73f5f3559b4d1139d

SHA512
92da359260afe58a6455c50428e30248f9a6c2ed81c1d385898bb65a5f010fba1035e69d454a77106b741856f6f2bc40590b7686b324ae8ec6c80b446ddf6362

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
memory/2616-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-69-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-5-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2616-53-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2616-52-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-56-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-93-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-89-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-72-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-75-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-78-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-81-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-83-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2616-86-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3328-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3328-0-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads