a01cb99b836799f7d06e99548868e50a61879bd5c72c6f6e29b713d7dff2b80f

General

Target

53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe
Size

163KB
MD5

53f3591762ec49e9be3483922c228fbb
SHA1

7b5d3b701287cb7a2508b9e45c8fa1401300d475
SHA256

a01cb99b836799f7d06e99548868e50a61879bd5c72c6f6e29b713d7dff2b80f
SHA512

047191b86ade765641057993df0ad322fed536c94c485892d47da25456bb6a91a908aad8f7378bfb471b21f0f96b0126ff48f3a39a5977022da3da03eb9810d0
SSDEEP

3072:shPP6uqulmpjtbhzYtJxvQFt5YT3GNFRP3DAhYuHQ:cPCETPxvMt5YT3GhvDA

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3000-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/2192-17-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/2192-19-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/3000-57-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/4596-120-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/3000-175-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral2/memory/3000-199-0x0000000000400000-0x0000000000444000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2192	3000	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe	87
PID 3000 wrote to memory of 2192	3000	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe	87
PID 3000 wrote to memory of 2192	3000	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe	87
PID 3000 wrote to memory of 4596	3000	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe	96
PID 3000 wrote to memory of 4596	3000	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe	96
PID 3000 wrote to memory of 4596	3000	53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\53f3591762ec49e9be3483922c228fbb_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9F5F.B34

Filesize
1KB

MD5
c99d1e399159c312b58c43fcfc80f0dd

SHA1
9973467b1eec45a65131139468104862f74713c8

SHA256
e1982022ad6681a3c6c33fa20cb7e5e4406cbee966216bd313c779d2a881e0f4

SHA512
f58975b57bb2a0e28d40d576fb5e63b4ace6eda5d20e0e85a8ee998c390e8efc4a5d30dd195d3e888bf077adde1dd5da3ceb59250904788b087bd275665b0d59

Download Submit
C:\Users\Admin\AppData\Roaming\9F5F.B34

Filesize
1KB

MD5
356b371fac60d0e50d7b336504c3be15

SHA1
cd63189f893ad5e544f2be88937e5c4d49e0d4f4

SHA256
041434e7545be8a358551ebeffec4568a0981e35472716a7e8c5910cd70d53d0

SHA512
39aaf599da7b09536b44bdc1e0d32142e8a590ddd7f11283fba05527812fcb319085f8557e7f7f0c5f32eda4f5f9be96aff3c56dd8a26310450dfdff0d194374

Download Submit
C:\Users\Admin\AppData\Roaming\9F5F.B34

Filesize
1KB

MD5
b75114a0e81db09d463dd5c30f173932

SHA1
6d8b294219c731d04050c6e27bc1ac4b8820c54f

SHA256
408a009e6db0dd289c961ef454f90eebcb1c5314710db5271a2354aae883efc3

SHA512
fbc65efdee5f4f98c844bfd3bb3fe703c28a834be4b022728d281004e8a896b21f69482dc93ac85c14b3db680ea977bb068c5755b75ab33fc0073b613001082a

Download Submit
C:\Users\Admin\AppData\Roaming\9F5F.B34

Filesize
897B

MD5
4ba5270d66233e9972392562e56a16c0

SHA1
809e11ed2cc3d143ef4c4c072e44e96d2cc567ba

SHA256
f609a137d22c5bb8b127f3eea1af7d7b616b110a7063c02452040585253c98ef

SHA512
ccf62d28e1cfc028d692d2c47c3730c1df2ba6121bc84d1add2596ddf9218705d6addf8f125c63fcdc6f65b6baa45d5fea65f52de6176d13b6805f9c395a25c9

Download Submit
C:\Users\Admin\AppData\Roaming\9F5F.B34

Filesize
597B

MD5
620921a7496e58f4ab0625690557e625

SHA1
3524a905177c72b5b1de0c9a192255613ffaa273

SHA256
1362baeeffb553e2852bf00cec05347d58a46bda74fec23e994e7ac779ca049b

SHA512
914289d1b413080d4da9f3e1baff55b79ce63540af6d78baef9b310ba16243cb58bfa988e9a7d56a35aafaf85eee8b42f89009c02a5c2fa9cc01b2216646c1d3

Download Submit
memory/2192-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2192-19-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-57-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-175-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-199-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4596-120-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads