349140be156d7e3a8784c79ccc3a034dcd1c942f7665bb53563bf50f2870ccf6

General

Target

0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
Size

4.6MB
MD5

0ea2ee0f0f43bce02adbe9600149a093
SHA1

dee5fc575a3894edf3d6fdc3523d915469a7810c
SHA256

349140be156d7e3a8784c79ccc3a034dcd1c942f7665bb53563bf50f2870ccf6
SHA512

989b09303c88f990370cd2da4b8830488059e92ccdcebdaecc6224da9345dceca4f87fe1bb4f2d6b55e2c04fe604a6ade19e1aa5e39c1db81ee00e86b5d5bcac
SSDEEP

98304:812CEHifqugmFGFbVLttyC0aDzrM5SqDqTmEn7Fb7u5Kv:8/1fjdwfMNE7FW5Kv

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000235f0-5.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
224	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
224	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2588 set thread context of 224	2588	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe	89

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000235f0-5.dat	upx
behavioral2/memory/224-9-0x0000000009290000-0x00000000092EB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
224	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
224	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
224	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 224	2588	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe	89
PID 2588 wrote to memory of 224	2588	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe	89
PID 2588 wrote to memory of 224	2588	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe	89
PID 2588 wrote to memory of 224	2588	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe	89
PID 2588 wrote to memory of 224	2588	0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0ea2ee0f0f43bce02adbe9600149a093_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4276,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\137590504\css\style.css

Filesize
435B

MD5
084e5106247df179675832e604b6fdb4

SHA1
99251e5d1acea608b5c7b9d4562eafc8aa4d831a

SHA256
c329401e50e3874130637abe653b3956ca9b9c4cb7edfe29940a6d043cd50118

SHA512
872ea0e6a5ba079618b9185e2ac1d8d4a101888aa96545281aaf5c833303ab5b9af7665c9028a62ee5272ad52092ec41668962923abb1ed30efc7a1213939f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\137590504\images\clear.gif

Filesize
43B

MD5
9bb191c6827273aa978cab39a3587950

SHA1
25d8043336eb799e52b1a0e15ff6b95e09c24e35

SHA256
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

SHA512
c3970b9a8dc9b424528274e8d22d21e9990ce956aede61cba13de8d7832a8c896eaf1032662a78e95980ea013090cd4406f32604da3c6f557aa136842d04324d

Download Submit
C:\Users\Admin\AppData\Local\Temp\137590504\images\line.gif

Filesize
43B

MD5
edd0fd087a54df4dbcf0afa8e309629f

SHA1
ad944d9989a0dd6fe9f471d511d755b8c53517be

SHA256
0aff2a7ec123f7f837dded84bb0f3ba8f43e39e2298d57d06f8b29eb485a825c

SHA512
a90f00493e3b45bc4d8422164acd7b7ed63bcab533cc5376c1818fd76962e1617e1c8b95dcccfd4492c251ab69d30e3c8d1e38596bc933bc631afdb2981fad0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\137590504\images\logo.png

Filesize
1KB

MD5
d12cd9eb799d4d097a00917d4ac7f30d

SHA1
e26599a6fa177cdd3dd4d8cf2a15934344b4e17a

SHA256
ae0c3f8725b938e82c6f02b601aceeffab4b871b5eca9ba6e78f07439019ea77

SHA512
108f5981f26f65889af2fd04b47ffc10355550a8745846a934a61bfd808b0316c3cf8c4a385ca5374f72c1eb4f12a735c47af0cd351c5cc12db48ec039c36ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\137590504\index_ru.html

Filesize
1KB

MD5
52c165d944ebe25ad3cd557e6b6ec200

SHA1
6e07f8d6ef54b9d5d26c743fa5adf6c5703cd4b8

SHA256
8151eb2606b7736da9cfeff95177d3e37695328f910d251b808ccaf78661ad77

SHA512
4389401a749621961f4f0b507f6a08e61cb74f008b32f81a2984554b482384df6fcf5875da7e5e8751974f0926f8527742562dd0de4aef403f8b230f4ec1a310

Download Submit
C:\Users\Admin\AppData\Local\Temp\137590504\js\lang.js

Filesize
632B

MD5
f3ca8504fe38798d402ada65acc0923e

SHA1
8f9930721e2a559be8e4379cb6e9dc9ffd71ef52

SHA256
f4b4d8d4bb78d970a3fcf6dc8ee0353776801ef373b54d839cd8853c1481a378

SHA512
ab1324ec6f5dcd034efadb6eef3224244de5eb328a4c28e4646a7a182d6af2ec60dad50f52b1e8aedbe18e3eb6a03a4705949763746952492e9abb0f9e01bec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\137590504\js\unitpngfix.js

Filesize
959B

MD5
997b4c4553a419650ec27b7f53cd94ef

SHA1
13a577fe4669412ef3d54bd761ff7878876079c1

SHA256
a044dffe80c9ce80d2364681836b7835fdc1c49f30ba83192231e5089973c9a4

SHA512
5f423448c03f1f79b4cc326125e27e60a57bf54c9c834c6be6b848712a814c71376a2def86bb5bbe20c4856798ee88560222f9ff60a9e81a5ece1110d7ef76c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{154B3CCA-0590-4D57-8AF2-2FC5C569B276}.dll

Filesize
120KB

MD5
c9f333d1ff898672a34805f94a265329

SHA1
2deaac66698fb2e9b3868d23034c3211c508b739

SHA256
07e546811635574c77edfda126b0e5f5292b4ea13f35158eddedcfc3cbf74b6b

SHA512
048c71e48e2def0bfc69ebfb69b834d650a9377082782333f50728fdfd6675df8093d0c87e606022e55d09f81549d4ca3b640bcdd33b9ddc9aace03ee1466add

Download Submit
memory/224-0-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/224-9-0x0000000009290000-0x00000000092EB000-memory.dmp

Filesize
364KB

Download
memory/224-1-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/224-109-0x0000000000400000-0x00000000005A3000-memory.dmp

Filesize
1.6MB

Download
memory/224-111-0x0000000009290000-0x00000000092EB000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing