33a365cd25fcbb0b7b8a4c6ab48d6e5906c4a8e5e5f701f33925253b521e2e57

General

Target

faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe
Size

288KB
MD5

faf828c3979446d42bc45c49a61b8dc8
SHA1

e186b1b62cbba0b1adc4f74525e5b5e901eb1ebc
SHA256

33a365cd25fcbb0b7b8a4c6ab48d6e5906c4a8e5e5f701f33925253b521e2e57
SHA512

853acf376be4c6afffc99707b9d6bc1aec82426aec6b335cd65b4477f02168bf4ee98fb4bb65bd65dd2007200fb7cfee6250285e45e36f2b473cbe9422dc0ca2
SSDEEP

6144:rJlZSBGgRIRhc45O7GLTWsweAF8M3A2hu7QxterCffIdP7b4nYFoS:rJlZSBGr7c/GLTPnJMw2huEqWffAX4Yv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2672	RemoteAbc.exe

Loads dropped DLL 2 IoCs

pid	Process
4692	IEXPLORE.EXE
4692	IEXPLORE.EXE

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x00070000000234cc-14.dat	themida

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 4692	2672	RemoteAbc.exe	83

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Remote\RemoteAbc.exe	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Remote\QGKWOT.DAT	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Remote\QGKWOT.DAT	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RemoteAbc.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4692	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4640	4724	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe	84
PID 4724 wrote to memory of 4640	4724	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe	84
PID 4724 wrote to memory of 4640	4724	faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe	84
PID 2672 wrote to memory of 4692	2672	RemoteAbc.exe	83
PID 2672 wrote to memory of 4692	2672	RemoteAbc.exe	83
PID 2672 wrote to memory of 4692	2672	RemoteAbc.exe	83
PID 2672 wrote to memory of 4692	2672	RemoteAbc.exe	83
PID 2672 wrote to memory of 4692	2672	RemoteAbc.exe	83

C:\Users\Admin\AppData\Local\Temp\faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\faf828c3979446d42bc45c49a61b8dc8_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CRHNBI.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640

C:\Program Files (x86)\Remote\RemoteAbc.exe
"C:\Program Files (x86)\Remote\RemoteAbc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 55314
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Remote\QGKWOT.DAT

Filesize
28KB

MD5
a8a23dd7e249b1ded8ccd447127bb6c7

SHA1
a1f3ad471505bee6e3da4b7e64bab3cb25be593c

SHA256
75b35ef00d1927653d15540f2fe2dd2b0d7fb35812385ba4f381428a5ae36762

SHA512
4d8f72ae9cf73cbd685b0c30582de921ba11c388ce05bd4150efa826e2d3e3a4c6dd5784fc92b18c66c086c70cd5e6682991fe1657293504ee10544564805c6b

Download Submit
C:\Program Files (x86)\Remote\RemoteAbc.exe

Filesize
288KB

MD5
faf828c3979446d42bc45c49a61b8dc8

SHA1
e186b1b62cbba0b1adc4f74525e5b5e901eb1ebc

SHA256
33a365cd25fcbb0b7b8a4c6ab48d6e5906c4a8e5e5f701f33925253b521e2e57

SHA512
853acf376be4c6afffc99707b9d6bc1aec82426aec6b335cd65b4477f02168bf4ee98fb4bb65bd65dd2007200fb7cfee6250285e45e36f2b473cbe9422dc0ca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CRHNBI.bat

Filesize
218B

MD5
4e4ab7d81b93ae170a92ad9c1f9f23f8

SHA1
3803455db1940a4a438799f248044840043d2071

SHA256
cafdc33d1acaf0ad6739d2cbc15043629ceb04aa9b91799326849a3309e33e1a

SHA512
eae68929614f191a6c24b3310a2164fcf96e83c3b04a80717eca61130a10b86608323bce9044f93702205e72a2b38dde814d8d5f177701893d5ce43bbeaffc2d

Download Submit
memory/2672-7-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2672-17-0x0000000010000000-0x00000000100BF000-memory.dmp

Filesize
764KB

Download
memory/4692-10-0x0000000010000000-0x00000000100BF000-memory.dmp

Filesize
764KB

Download
memory/4724-0-0x0000000010000000-0x00000000100BF000-memory.dmp

Filesize
764KB

Download
memory/4724-1-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/4724-12-0x0000000010000000-0x00000000100BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing