1a71afe1b7c1808b098cbbc80ef8341535ed226048a2cdfc5e70073193ccc85a

General

Target

JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
Size

467KB
MD5

9744a4bd414f25dbafcbc9be1f6bfaf5
SHA1

70a1e83572f04db593e7566398b83bc2b8439150
SHA256

1a71afe1b7c1808b098cbbc80ef8341535ed226048a2cdfc5e70073193ccc85a
SHA512

f3496a58e18c721f25a9e385be427bac6ca9cef601245e8fb9020cf6d9290e444dd80a573c8160a1e8535944717ca304790a117e8cde6e72db223d4622bfde86
SSDEEP

12288:eevI/fxAG1HRswo4pjAVFWrQrQYsK5debb:xvsaoRXpjAVu3YsKTev

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2556	75274115.exe
596	ab91c0a0.exe
2424	5a88085a.exe

Loads dropped DLL 6 IoCs

pid	Process
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	ab91c0a0.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2424-36-0x0000000000400000-0x000000000044B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75274115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a88085a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
2556	75274115.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2556	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	31
PID 2356 wrote to memory of 2556	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	31
PID 2356 wrote to memory of 2556	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	31
PID 2356 wrote to memory of 2556	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	31
PID 2356 wrote to memory of 596	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	32
PID 2356 wrote to memory of 596	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	32
PID 2356 wrote to memory of 596	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	32
PID 2356 wrote to memory of 596	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	32
PID 2356 wrote to memory of 2424	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	33
PID 2356 wrote to memory of 2424	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	33
PID 2356 wrote to memory of 2424	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	33
PID 2356 wrote to memory of 2424	2356	JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9744a4bd414f25dbafcbc9be1f6bfaf5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\75274115.exe
  C:\Users\Admin\AppData\Local\Temp\75274115.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\ab91c0a0.exe
  C:\Users\Admin\AppData\Local\Temp\ab91c0a0.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:596
- C:\Users\Admin\AppData\Local\Temp\5a88085a.exe
  C:\Users\Admin\AppData\Local\Temp\5a88085a.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5a88085a.exe

Filesize
177KB

MD5
bcdf2d4b035b4728ab54ff1ef8510be8

SHA1
28454bb6a086c9a93b8053e1d7b8a78e5098542a

SHA256
4d5a241845c90174038021cdd5e730e99a2282cce051915ce56149093e3d9de3

SHA512
d5f89c2d63f8b8307f77b68a34ba01b2be696a3169191e58d09676f90871a16d57b963412a4fb88fe34a915d18cab26017248f259f01ec0c1e81b16d7b25a1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab91c0a0.exe

Filesize
229KB

MD5
3666be7d20dddc2b2b43cde418c6decc

SHA1
c1a224b698c99b20b9e2e8f3a68853cf37a521a9

SHA256
8ed9ac5c251051aa7667ec29a433f5e0f136df60adaf2afe987e819d4ea38a59

SHA512
b82d5fa72e830349dd189b57ac3c86d1563db51a979f994b995c83f9c1cf2a44c6d68f0397f5b96044931c2b07a5564a1be4a2e33efc9baeef3ed59444202684

Download Submit
\Users\Admin\AppData\Local\Temp\75274115.exe

Filesize
18KB

MD5
2d739c82071c718e748e9026ca074208

SHA1
0e053115f1953da4392e653b8d2a3128fba8f707

SHA256
6656660333182d69b7f4533b532e639151cd4dbd6cf6962daa5f2b6859bae4df

SHA512
0dca57d252d1a960f7e9ef2c98d336191d93dce0a478ed35aefe9cf06abafc1c7c760341bf3a9a4129baee54b84953498bf5d81fd9111b95a99d60c3baabc303

Download Submit
memory/596-32-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/596-22-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/596-21-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/596-33-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2356-31-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2356-1-0x0000000001BE0000-0x0000000001C58000-memory.dmp

Filesize
480KB

Download
memory/2356-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2424-36-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2556-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-11-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads