e26ed430d6f0608113dfc0b37670e3c6994fc81f80643007e146f8ecabe33a78

General

Target
5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe
Size 348KB
Sample241019-ls68hszbrc
SHA256 e26ed430d6f0608113dfc0b37670e3c6994fc81f80643007e146f8ecabe33a78
MD5 5c095a8242ac122b43e534c4332350a8
SHA1 b91016bd8212ea3420e075b97cff6a092c5870ed
SHA512 26b695af2dabd9d8f1bd5655517e4a90f99a95110ae2519836031a1b28f7c12077e1821a49e598769cb485fdedf499fdfd0f732bfcda9d8fa6fc00ec84817d24
SSDEEP 6144:LKwLo74p0yN90QEQ4ICzPbyJpBqt6/kh+NWfTZwwgXdkaB6OIqs0:vLo9y90pbcpQtAn+ZlOIqs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1620	300414~1.EXE
2284	setup916.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b78-8.dat	upx
behavioral2/memory/2284-9-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/2284-12-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3448	1620	WerFault.exe	84
2624	2284	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	300414~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup916.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1620	2928	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1620	2928	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe	84
PID 2928 wrote to memory of 1620	2928	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe	84
PID 2928 wrote to memory of 2284	2928	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe	91
PID 2928 wrote to memory of 2284	2928	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe	91
PID 2928 wrote to memory of 2284	2928	5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c095a8242ac122b43e534c4332350a8_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\300414~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\300414~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 600
    3⤵
    - Program crash
    PID:3448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup916.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup916.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 576
    3⤵
    - Program crash
    PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1620 -ip 1620
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2284 -ip 2284
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

300414~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\300414~1.EXE
Size 123KB
SHA256 1b8aa79364ee9cdcc7ff68bad9e8e0a21972bbc4d1dbc9a142451547c8d05f90
MD5 4a0f4e48c44cde6a1a3779538b0f32b9
SHA1 3fecab183cea5ebf3874e6462104b6313715f427
SHA512 a0d7688baa15787ebfa20d55113961e2c0c2ce75d8e3531f093eee58bfa603cb12f557789f1b1f27ff4443c454733f83eeecc5b97f3ab3091864cd1352fa5751
SSDEEP 3072:noAvkg8k854K13IsmbH3XKTjjDS7sj3j00URefP/6W:n8iK18bXX+32Yj3Q5
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup916.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup916.exe
Size 85KB
SHA256 d80cd40e8771c0491c22ee491f96efcd14ac43b9598d7505bf4db630a9d63bb2
MD5 9a2862094c5ec55483a1837ee1f0fb7a
SHA1 dc3f740a1a27c60e49ad0c75733644606212ff0a
SHA512 f2f1043837cfe9505462c57011510a8515d0946eb9b2a166ba7428360c81e89666647cfe1cd52877e373a09eb695b81fbca25ef1db5e95f89c2fe48d367b9874
SSDEEP 1536:vJUC+QmbUxhPu7oQb1BsA0/r8Zy15cwXRT4Lxb3CVmXos6ulv09VUX7yBuVCjukT:vJUoPu7oQb1yAccy15cwXq3CwXobulvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2284-9-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/2284-11-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/2284-12-0x0000000000400000-0x0000000000432000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads