c3dedd3b494d71f60993a95296c44590b2b91f0d8885468c43b755d17ae01908

General

Target
e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe
Size 99KB
Sample240407-1c9e9sfc67
SHA256 c3dedd3b494d71f60993a95296c44590b2b91f0d8885468c43b755d17ae01908
MD5 e5e57442b6ada75519a6b698bf069e9e
SHA1 2f06aa05298d7c7e767518da26b4026b48938d6c
SHA512 156ba022e1b52ce97c635e55ee84e9d423d6d032249aac40d52213c6f8b3c8d7eedf3f43b607e506bc1fd511d0cf97ab5777ca9d9c5b6e891b418c477dd7edb2
SSDEEP 3072:sr3KcWmjRrzSoYLmMhL5WdLXzF1uOShCr8ZO:/Y2dWBGOShCr8ZO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1424	5N4uvBWvhAaE5Hz.exe
2636	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1476-0-0x0000000000990000-0x00000000009A7000-memory.dmp	upx
behavioral2/memory/1476-6-0x0000000000990000-0x00000000009A7000-memory.dmp	upx
behavioral2/memory/2636-9-0x0000000000110000-0x0000000000127000-memory.dmp	upx
behavioral2/files/0x000b00000002316c-8.dat	upx
behavioral2/files/0x0003000000022744-13.dat	upx
behavioral2/memory/2636-32-0x0000000000110000-0x0000000000127000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe
Token: SeDebugPrivilege	2636	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1424	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe	88
PID 1476 wrote to memory of 1424	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe	88
PID 1476 wrote to memory of 1424	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe	88
PID 1476 wrote to memory of 2636	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe	90
PID 1476 wrote to memory of 2636	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe	90
PID 1476 wrote to memory of 2636	1476	e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5e57442b6ada75519a6b698bf069e9e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\5N4uvBWvhAaE5Hz.exe
  C:\Users\Admin\AppData\Local\Temp\5N4uvBWvhAaE5Hz.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 357KB
SHA256 42f69f2e48e9270f82eca0fbb661694d82076c457c291e149874b9ab2e00fd97
MD5 cfdbc2dc8feedb0c208902e3d36f56be
SHA1 86cde98ef4b14923eaa873df404c4f7739b71eab
SHA512 3418608adec779dea394e05ad80c6241c441a36bd7434109f3ceb467f0258f5c2d9b37d00c063a58f38b40900d4a38c8b9aa705bcbcd101080cc667f7558d4b7
SSDEEP 6144:/TgLRS+HLWR32UWHokDxxtegQMMrUpDkUnsE40C2rXvZBBfNJcPlvD1ilP1ezlZi:/TgLw+CNvEhDxm/rUpDkjEP5DvR1JcPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

5N4uvBWvhAaE5Hz.exe

Path C:\Users\Admin\AppData\Local\Temp\5N4uvBWvhAaE5Hz.exe
Size 64KB
SHA256 75f12ea2f30d9c0d872dade345f30f562e6d93847b6a509ba53beec6d0b2c346
MD5 a32a382b8a5a906e03a83b4f3e5b7a9b
SHA1 11e2bdd0798761f93cce363329996af6c17ed796
SHA512 ec87dd957be21b135212454646dcabdd7ef9442cf714e2c1f6b42b81f0c3fa3b1875bde9a8b538e8a0aa2190225649c29e9ed0f25176e7659e55e422dd4efe4c
SSDEEP 768:2jfnJFqNSkejOy27eW2Vef/7yX3jFICnFfvoUs49RsS98Pu4TNz14GAeRgxQ:ufnLq01weW5yX3jFxv49Nu4GhQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 35KB
SHA256 a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
MD5 93e5f18caebd8d4a2c893e40e5f38232
SHA1 fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA512 986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54
SSDEEP 768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+I:s9Z3KcR4mjD9r8226+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1476-0-0x0000000000990000-0x00000000009A7000-memory.dmp

Download

memory/1476-6-0x0000000000990000-0x00000000009A7000-memory.dmp

Download

memory/2636-9-0x0000000000110000-0x0000000000127000-memory.dmp

Download

memory/2636-32-0x0000000000110000-0x0000000000127000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads