6831c7cb5d52c4e0117942908e88a8eb79c8565ad1873e19c343575599a42fa3

General

Target

449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe
Size

57KB
MD5

449e782d3fa54ce443cb78abf8f2a5ef
SHA1

37c9046ed6a8b584090831ef545d0d2f4643a931
SHA256

6831c7cb5d52c4e0117942908e88a8eb79c8565ad1873e19c343575599a42fa3
SHA512

3217a893ce61ed8ae2a4884f003b63ed3686600f18998ea3150666d798066248541b8fe556942c73a4c37e160fda8b6b58347aba33e65335d89e2a208e257c24
SSDEEP

1536:Cz1E2yOg5wlBIm6BadXRy1ruwYWoByJX9MMIvnouy8:KFZgerIm6M3y1FwBIX9/Cout

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
624	tapinstall.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2456-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2456-9-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2456-16-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\OemWinxp.inf	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe
File created	C:\Windows\tap0801.sys	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe
File created	C:\Windows\tapinstall.exe	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe
File created	C:\Windows\OemWin2k.inf	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	tapinstall.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 624	2456	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe	84
PID 2456 wrote to memory of 624	2456	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe	84
PID 2456 wrote to memory of 624	2456	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe	84
PID 2456 wrote to memory of 2468	2456	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe	105
PID 2456 wrote to memory of 2468	2456	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe	105
PID 2456 wrote to memory of 2468	2456	449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe	105

C:\Users\Admin\AppData\Local\Temp\449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\449e782d3fa54ce443cb78abf8f2a5ef_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\tapinstall.exe
  C:\Windows\tapinstall.exe install C:\Windows\OemWinxp.inf tap0801
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 RunMs.tmp RunMs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\OemWinxp.inf

Filesize
6KB

MD5
b68dfc7e0ca5f9b26613c736b9416426

SHA1
a4b9de9b94f0234ee17b28b5830844d6e76d110c

SHA256
078e5caf23f1aa83ebc82e7a6ca1a6799e84e116d2fd7db029c52dbbf80432e6

SHA512
65256f03f365089ea5562de2e9ee5188a1f4d96741e2ca95fa722722b68e1d53a6bffc940adab5ac4882cd901775320b548cdfb178ac3552057450342712d8ed

Download Submit
C:\Windows\tapinstall.exe

Filesize
54KB

MD5
b36c5e40f25c8afe8c8acc7e895d9c6d

SHA1
e3ab57d8cf17aa6156d417963b02a2e659a5c5fb

SHA256
64f42467a18009ae3d7cd24ed140141afd31826761944bd4e1891ea9f02411c9

SHA512
6902789b6d44b7e6caa6010bdb5fb05073cbee1a5d51795cd5854ac7ab18c9eda1620dfed9249c0afa299646947766f5a53e9ef8d60a89eac8e8cc5c9570dfe9

Download Submit
memory/2456-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing