dd3ca0ab292cef0f2075031ceabee92002a4f0bb34e37f4518fc88047f4743ff

General

Target

c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
Size

14KB
MD5

c971021b0d4d8a5f87e0dbd698dd12bd
SHA1

995f7814856df1226de3143a3edf4483d0d6d0fc
SHA256

dd3ca0ab292cef0f2075031ceabee92002a4f0bb34e37f4518fc88047f4743ff
SHA512

072123545ae17610d27a8c4493de6779827360a9507f46c085152b4800b81c1e4d4acfbddf0baf3a8415f41114d181e7d2817678b9b8477262fbd3776fad79a8
SSDEEP

192:f6CUE6u82EfdYLglIS+RJ9XYHdO5SNrh6KBMUOmOzzLcmrajhjkJ:f6o6uFmdY8lJQJ9XYHQ5S9cKImfwaGJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	gth60328.exe

Loads dropped DLL 7 IoCs

pid	Process
2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
3032	gth60328.exe
3032	gth60328.exe
3032	gth60328.exe
3032	gth60328.exe
3032	gth60328.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmsfc1.dll	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mmsfc1.dll	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ComRes.dll	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gth60328.exe	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral1/memory/2356-13-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fonts\ComRes.dll	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
File created	C:\Windows\fonts\gth60328.ttf	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
File created	C:\Windows\fonts\gth60328.fon	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gth60328.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
3032	gth60328.exe
3032	gth60328.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	gth60328.exe
3032	gth60328.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3032	2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3032	2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3032	2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe	30
PID 2356 wrote to memory of 3032	2356	c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\gth60328.exe
  C:\Windows\system32\gth60328.exe C:\Windows\fonts\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\c971021b0d4d8a5f87e0dbd698dd12bd_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\fonts\ComRes.dll

Filesize
11KB

MD5
8dbaf2906dd867e1d57499c3864f5d9b

SHA1
7c84b0f830a07680c709c5a1b31a241e6bce0ba9

SHA256
e19e94ec89d7a66fc798b56dc2d15dae247fb39c6432a27b1bd86811082a48ed

SHA512
6b776a801ec473eca8992003dddab9b336142dc2549120e18f648c61ff52a7e14485765d082df31397b770aeef949389977c367863cbbd29fe17df943d2b5783

Download Submit
C:\Windows\fonts\gth60328.fon

Filesize
1KB

MD5
6ab3811e869fce33b71d3ed3a5a138b8

SHA1
07ca34fd88b1eedfdd96229ab5c948813b1d10a5

SHA256
8136ae96c874f093ef73cdde71222f7f0f8be4b4e9864f2bd45d0d86c14b1eb5

SHA512
3b6b537cddaa6a05988d28c78c506711019e2218b2bc5b68e4f8da5943e56677c9ff3eaf7e73bfc2139489e190f6d1c536e90532c63c9f7626a03098cccbbd3e

Download Submit
C:\Windows\fonts\gth60328.ttf

Filesize
24KB

MD5
def98304b722db1c20aeedb8d36f8674

SHA1
dedc8cec7bd40580658a503c3575eb04387e99db

SHA256
39e5f1d7b5a0bf578a30ad556e2e4aa20d535db2821eed0e6775d937fbd36bd1

SHA512
dc95c3ef00c323d8cf680affb24a1131241da9c35083d2acd72ca031053c07acad69377ff8989b942d424c5e50f28a682db6bcb900127f503329946a1de673d0

Download Submit
\Windows\SysWOW64\gth60328.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Windows\SysWOW64\mmsfc1.dll

Filesize
40KB

MD5
84799328d87b3091a3bdd251e1ad31f9

SHA1
64dbbe8210049f4d762de22525a7fe4313bf99d0

SHA256
f85521215924388830dbb13580688db70b46af4c7d82d549d09086438f8d237b

SHA512
0a9401c9c687f0edca01258c7920596408934caa21e5392dbaefc222c5c021255a40ec7c114a805cdb7f5a6153ec9fa9592edcc9e45406ce5612aa4e3da6a2c4

Download Submit
memory/2356-13-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2356-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3032-20-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3032-24-0x00000000000F0000-0x00000000000FB000-memory.dmp

Filesize
44KB

Download
memory/3032-26-0x00000000000F4000-0x00000000000F5000-memory.dmp

Filesize
4KB

Download
memory/3032-21-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3032-27-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/3032-28-0x00000000000F0000-0x00000000000FB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing