ede2fe4439c44ff006555c8da07854142de394492d46302d6ec69f7df554e2d4

General

Target
e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe
Size 416KB
Sample240407-xalpmsbb7y
SHA256 ede2fe4439c44ff006555c8da07854142de394492d46302d6ec69f7df554e2d4
MD5 e59957e856fe46334231d1f88baeab8f
SHA1 8288a39935022856e56adbb5b2970c693b03b0b5
SHA512 8febafbb0333a63efa7339d0f42384310d31f866ac334211faf1f3753468df87f00ddfeb770cf2b4531cc6c726b9dfb671313b27fde3299cb33fa920a332714e
SSDEEP 6144:sZl2wr7JVo8GEatDETOs1fccYvaE36KyPxHDEI9DGJqxQYHg0e+9y:smwPk8paeTOsfPE3hyd3RQY3e0y
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1320	hpmv0mtX4pg8FnB.exe
5024	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2752-0-0x0000000000450000-0x0000000000469000-memory.dmp	upx
behavioral2/files/0x0007000000023333-6.dat	upx
behavioral2/memory/5024-8-0x0000000000E60000-0x0000000000E79000-memory.dmp	upx
behavioral2/memory/2752-9-0x0000000000450000-0x0000000000469000-memory.dmp	upx
behavioral2/files/0x00050000000226b0-12.dat	upx
behavioral2/files/0x0008000000023332-29.dat	upx
behavioral2/memory/5024-31-0x0000000000E60000-0x0000000000E79000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe
Token: SeDebugPrivilege	5024	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5024	2752	e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe	96
PID 2752 wrote to memory of 5024	2752	e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe	96
PID 2752 wrote to memory of 5024	2752	e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e59957e856fe46334231d1f88baeab8f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\hpmv0mtX4pg8FnB.exe
  C:\Users\Admin\AppData\Local\Temp\hpmv0mtX4pg8FnB.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2828 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 405KB
SHA256 3b6b08c93f77a8119589f20cb3bd5d3c2d518af94453258be5e20c5f88234a08
MD5 7c2ff6941096d6fa1ca248f955809743
SHA1 f5d077e03b497c48fe6b19d199228867504618fd
SHA512 5b29ee7de05d73ebbc41c94849059c796afd00c694d89e61d690f89669034ed3a1970bdb7265bb0c96fe27e0a012a9f5688456bbe171d895b9a622e11efc51a6
SSDEEP 12288:smnoW8eawe6XCTjzPBxWPoxdf1ZZAd8JP:PQwXXCPzPBEPoxxT
MD5 SHA1 SHA512 SSDEEP

Submit Download

hpmv0mtX4pg8FnB.exe

Path C:\Users\Admin\AppData\Local\Temp\hpmv0mtX4pg8FnB.exe
Size 416KB
SHA256 dc9e5825914b04fee2f5f67205dbeb41317d707869bcb573ca0fe6545e7fa247
MD5 e2f216757d8b5277ff1238f95ed15950
SHA1 145ec1d4a1987109a5ca3bec07dd022711f68a95
SHA512 2335b76de398bbd658be92dde67c7625f0b991ab0e5358006624778ff5d7263870d6a91546fe6f75059ab5b80f1d01d82c04cace031a29dbab29fb3165011e6e
SSDEEP 6144:sZl2GcZPowGBW8QoYXc1KwcRHuTCZn5bN9OJfowqJhlk+QjbQb8Lex:smLZ3wUo4qCzzO2nGpQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

hpmv0mtX4pg8FnB.exe

Path C:\Users\Admin\AppData\Local\Temp\hpmv0mtX4pg8FnB.exe
Size 334KB
SHA256 58b7e175725ddf68a7a6c891889daaa3b7d4f90c14bfcff287cb3336cbd7da60
MD5 f310d4e936b68a5d76b7b808507e99f9
SHA1 6dccf493508f97212688413bec28f86befbff8e2
SHA512 daead56dfdd7b4a7a8fabdc6e12144273aae244aa90817d76281e5a7414e3f07ca2761f481bda91a47fc3c1c911ff1783e7421e566e3b3fc59b443de141d9e5d
SSDEEP 3072:5R4MYDAJyY8PPai8DqjX1yyTnTfqGuEGElJRsIxldzVerpYJlDwKSNL+gwCp4LJi:5G0OIyTTWSTRzVerpUNxFpmNKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 82KB
SHA256 c651b378896fad56ddeb1fec2c578a822bbb13269ec881f9420bbf47c9fbfbb5
MD5 546ffd2b72777e6a9e350780b79f99d4
SHA1 a620be74a2f432656e38e51cd02fbdc3e3b312c2
SHA512 57d49f830f9774ef0a4b6d026211360ea4ebcc6b236b72107401284559c7c589733bccc8af10c5a0cee5b97880d24a4e9954beb81887b1b124f8a42cca456fac
SSDEEP 768:XCNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2ZR1RGn8NIoGLLRNeo:UcNjQlsWjcd+xzl7SM+Gn8255Neo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2752-0-0x0000000000450000-0x0000000000469000-memory.dmp

Download

memory/2752-9-0x0000000000450000-0x0000000000469000-memory.dmp

Download

memory/5024-8-0x0000000000E60000-0x0000000000E79000-memory.dmp

Download

memory/5024-31-0x0000000000E60000-0x0000000000E79000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads