18bac69ca9f61fa36e49d2fbdb4015dcdf9791d9125cc45d5970fde1d70dd801

General

Target

da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe
Size

128KB
MD5

da7662fc079f089cefe7aebadf311efd
SHA1

c169aeeafa21b785a030a0e2159e0e75bb263f47
SHA256

18bac69ca9f61fa36e49d2fbdb4015dcdf9791d9125cc45d5970fde1d70dd801
SHA512

0248afdeb94c92c1fc2ea7e57e6a99c357874a72c35dec78ad5517dfa051c574653e8b7031cb55245a969b88f963ae51bc61104b29cc342ff3524ab8dd80049a
SSDEEP

3072:O+r5c07k6Oo+mNbXIPWPrfq4Ip5bYjS/fo+mNbXIPWPr:O85Rk6z+2XuWPrcNYcQ+2XuWPr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4608	outlook.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\sys32.exe"	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sys32.exe	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe
File opened for modification	C:\Windows\outlook.cfg	outlook.exe
File created	C:\Windows\crc32.cfg	outlook.exe
File created	C:\Windows\sys32.exe	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe
File created	C:\Windows\outlook.exe	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe
File opened for modification	C:\Windows\outlook.exe	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	4608	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4608	3856	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe	85
PID 3856 wrote to memory of 4608	3856	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe	85
PID 3856 wrote to memory of 4608	3856	da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da7662fc079f089cefe7aebadf311efd_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\outlook.exe
  C:\Windows\outlook.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 29868
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\outlook.cfg

Filesize
2KB

MD5
5ed207f52725ee68848174faea6026ba

SHA1
586244d8f7296b028724bbb3e2f456c9ecf7d688

SHA256
86511ab1a7782c82534a800050c2380482421fdcad00431eb8bce13729aebadb

SHA512
bd1e1b7ac70f6b68f28ccbaefc0d683c652961ab0caa54622077e65c4cd334cb63500e3969ba347e3a86258f098879e56a68526f8641924a11289ec4d450cec4

Download Submit
C:\Windows\outlook.cfg

Filesize
737B

MD5
ed01c721cc56336834ba3852cffbd2ea

SHA1
683599a8859ea35386742a9d94ac99f87482ffa4

SHA256
cdc569a8e1da691bbf8f7e320c4ac64222c77c46bfeb89e8a1014592d44d3da6

SHA512
1eccafcbbb2665e1ca055895770bd070178bfd4946f5dd556c6d1be6a4abac339ffb20b83ef2445abed5f48a064fc641a78c234092f622726ad459b3b53e7739

Download Submit
C:\Windows\outlook.cfg

Filesize
1KB

MD5
24374222b80065386e56d828c5720f21

SHA1
5dd0acda4907bd6a73e83af56325e047146da909

SHA256
8eb357b69134b97ab6c07d5a2b774c4c3b27f320c0c495a988fb451676d91c74

SHA512
0029cb6e156d14e1563e2ab09469ed9737b407fea825e437d4c02f791ddbfe1b8a029ffd71b8301122830fa84103b199142130b96ce3cde9f0726c049cf36d5a

Download Submit
C:\Windows\outlook.cfg

Filesize
1KB

MD5
8cc0e2d8d91945754217e74c9aa9f8b4

SHA1
dd27fc2cb6b4e15388e1416559df85addaa26962

SHA256
fd43c37b6659a99d86fb97c1ea8f1317cf9533bf631ec1479d18d6be10c2da7b

SHA512
93fcd7203d55a0c0bfd407b46fe399d44e6a3ba7d8e6c0a566cbeea3ead28354e616f29348eee6058715abc244495f1d82b858fa04c99c2d0c0d772460466730

Download Submit
C:\Windows\outlook.exe

Filesize
49KB

MD5
0e9379e357aba95f8b9883af9b67675e

SHA1
280a174a414e5b8588f42b6328af2c8c8ff4394f

SHA256
96b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28

SHA512
6cc383806882729cd889b025802ac0d5e1c55a74b3e7d7c98932644e8802fe52b5b14a886eff70ab7deaa70fb60bb9898e55b5cd83b5b99e2a2d107dce367784

Download Submit
memory/3856-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3856-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4608-9-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4608-84-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4608-106-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4608-122-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads