cdd312b1dcb61c0fe7159e1843d7196946ddaed486eb29631d235b4e3ab6ec9e

General

Target

6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Size

202KB
MD5

6656ae571524e891ababd80d01997fb6
SHA1

66414af5a956c34131a724dd1acba8ef9a9aa6f3
SHA256

cdd312b1dcb61c0fe7159e1843d7196946ddaed486eb29631d235b4e3ab6ec9e
SHA512

0c70b00ae201e3379c49ad89d3d97b7443c24bdf30953de1d9bf590d1f2e5e5a8eb5efffba1ee465c20abefb821d654530ff7db6a597e6608ce6655874352e28
SSDEEP

3072:jqpzUMKR8IZemcmPgFKw68CBHBHRHf0YG93lo/yFMplX+:jqpwz8I+Kw68U/tE3qyUE

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023cad-11.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
800	~240632281.tmp.exe
3860	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~240632281.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3860	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
3860	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
3860	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
4992	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 800	1844	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe	84
PID 1844 wrote to memory of 800	1844	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe	84
PID 1844 wrote to memory of 800	1844	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe	84
PID 1844 wrote to memory of 3860	1844	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe	85
PID 1844 wrote to memory of 3860	1844	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe	85
PID 1844 wrote to memory of 3860	1844	6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\~240632281.tmp.exe
  C:\Users\Admin\AppData\Local\Temp\~240632281.tmp.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:800
- C:\Users\Admin\AppData\Local\Temp\~240632281.tmp\6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\~240632281.tmp\6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~240632281.tmp.exe

Filesize
11KB

MD5
4e868495efa86e0f86cfb320be3450ab

SHA1
8e830b1c1f25beed46bb23abf9888ebab13a189f

SHA256
021d0831e2d7c9ec05c70e84a7e8d9bfdbf064ba0db0136062547cafa8a11fa3

SHA512
c2fa59870067695b642880504f12283079515cabf330d66219156ad0a4eeb2dc105e48f2fd25400d5c0fe17ffee5a7eb3f6703a3a529c79b2c2fca88f0f5fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\~240632281.tmp\6656ae571524e891ababd80d01997fb6_JaffaCakes118.exe

Filesize
189KB

MD5
ccb13723ac328e82ad6238457a8d9bfe

SHA1
4b470b3561df4069099d896ccb1edca52a302a4b

SHA256
4cf173071471f7359ba1b7082300a2a4558bd20a341fd1dba35cd5e4a88c553a

SHA512
a49074fa7ad5f40d566324b84e810fb4222355a806aab8cdd57013c3ab610604fadf51c0cf1660f0ea3a1daecca91839e0ba6293bfdb10553144cdbf8abab71f

Download Submit
memory/800-4-0x0000000013140000-0x0000000013149000-memory.dmp

Filesize
36KB

Download
memory/800-7-0x0000000013140000-0x0000000013149000-memory.dmp

Filesize
36KB

Download
memory/1844-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1844-13-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3860-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3860-14-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing