0a926d6036f9f1a99ff1320156bf4ada5fe301c4021e1c334c454de0cf85176b

General

Target
8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Size 15KB
Sample241031-b7tkvsxqgp
SHA256 0a926d6036f9f1a99ff1320156bf4ada5fe301c4021e1c334c454de0cf85176b
MD5 8115645464a33f8495cba27cfb9f0b53
SHA1 d3f479dba848c728aebd5ebb2085902166548b0e
SHA512 efd3028fd761ed97ca0b537995251b0d97e675f00d48631cf8a8be82ffe21e6b9a535fb507ab1a3a80b97d1939a1e135a004fb855a0fe733843f236f3f7758b5
SSDEEP 384:7F/xx/3MweRbMkMFKwtv5+cUJ5WhJyaaMW0y:BPFq7MVnJ8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery persistence privilege_escalation upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000023bfa-5.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mst123.dll	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mst123.dll	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3856-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/files/0x0009000000023bfa-5.dat	upx
behavioral2/memory/3856-8-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{fbe8d5e4-70a2-4c04-b9aa-299e7c9582e6}	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\PROTOCOLS\Filter\text/html	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\PROTOCOLS	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\PROTOCOLS\Filter	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{fbe8d5e4-70a2-4c04-b9aa-299e7c9582e6}\InProcServer32\ = "C:\\Windows\\SysWow64\\mst123.dll"	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{fbe8d5e4-70a2-4c04-b9aa-299e7c9582e6}\InProcServer32\ThreadingModel = "Apartment"	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\PROTOCOLS\Filter\text/html\ = "Microsoft Default HTML MIME Filter"	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\PROTOCOLS\Filter\text/html\CLSID = "{fbe8d5e4-70a2-4c04-b9aa-299e7c9582e6}"	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\WOW6432Node\CLSID\{fbe8d5e4-70a2-4c04-b9aa-299e7c9582e6}\InProcServer32	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3856	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
3856	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3856	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3332	3856	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe	88
PID 3856 wrote to memory of 3332	3856	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe	88
PID 3856 wrote to memory of 3332	3856	8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8115645464a33f8495cba27cfb9f0b53_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\811564~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

881C.tmp

Path C:\Users\Admin\AppData\Local\Temp\881C.tmp
Size 7KB
SHA256 b983e868c4f01b484d48afc34651d2c1826247f442bbd6d7dd822440f51b2da2
MD5 a3190385bc6fcb74beed9b7e3fdb8fb2
SHA1 0701134a97af908d6ef4061b365c41ab04c20f9b
SHA512 6268ed7cfb83393b8d289834b144cfc0d4374a07d96d3069c911fa96929cb49e2d20f9f3069c62faa693b9c10d430a7e7a3478db86ce28bc491c3f365b8b4d2d
SSDEEP 192:hyukuX1ocN4avubi35Jv91ZVFlstU7DWm:ZkkOcOakob11vTWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3856-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3856-8-0x0000000000400000-0x000000000040D000-memory.dmp