3e088b464ade52e935c9b99f62ca3f490dc777ab2396fddea93d08b213c77abf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe
Size 761KB
Sample240408-amxw4sbb83
SHA256 3e088b464ade52e935c9b99f62ca3f490dc777ab2396fddea93d08b213c77abf
MD5 e632d3604cdff042815f2d18859d1fc2
SHA1 47c4732ff3f279c98e426b19e3e910b93f86b8f7
SHA512 3dea9185c079bb8b0ef4fe529814672e91fdde636e21e6bca83fa8b95375f1ee53958ff1751128d21dc21c35871bbc6695d292daab9fb4b88b11885053a668cd
SSDEEP 12288:WCm5RLVrccv5KbK0I5dQW0I1mdjXR/KfUef8Ghcl6ezBSdWQ9FSAHjFy3AOBu5M:WCARLXVV+I1mNw8eftSlLnQ9FXHg3AOG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection persistence spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 2 IoCs

pid	Process
4908	Update.exe
3840	Update.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4356-0-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/4356-2-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/4356-3-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/4356-5-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/4356-4-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/4356-18-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/3840-25-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/3840-32-0x0000000010000000-0x000000001005A000-memory.dmp	upx
behavioral2/memory/3840-33-0x0000000010000000-0x000000001005A000-memory.dmp	upx
behavioral2/memory/3840-36-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/3840-39-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/3840-41-0x0000000000400000-0x00000000005BF000-memory.dmp	upx
behavioral2/memory/3840-43-0x0000000000400000-0x00000000005BF000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Secure-Soft Stealer\\Update.exe\""	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 4908 set thread context of 3840	4908	Update.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	Update.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3840	Update.exe
3840	Update.exe
3840	Update.exe
3840	Update.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 1524 wrote to memory of 4356	1524	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	89
PID 4356 wrote to memory of 4908	4356	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	90
PID 4356 wrote to memory of 4908	4356	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	90
PID 4356 wrote to memory of 4908	4356	e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe	90
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 4908 wrote to memory of 3840	4908	Update.exe	91
PID 3840 wrote to memory of 2920	3840	Update.exe	92
PID 3840 wrote to memory of 2920	3840	Update.exe	92
PID 3840 wrote to memory of 2920	3840	Update.exe	92

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Update.exe

C:\Users\Admin\AppData\Local\Temp\e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e632d3604cdff042815f2d18859d1fc2_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Roaming\Secure-Soft Stealer\Update.exe
    "C:\Users\Admin\AppData\Roaming\Secure-Soft Stealer\Update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Users\Admin\AppData\Roaming\Secure-Soft Stealer\Update.exe
      "C:\Users\Admin\AppData\Roaming\Secure-Soft Stealer\Update.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      outlook_win_path
      PID:3840
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Autorun.vbs"
        5⤵
        Adds Run key to start application
        
        PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Autorun.vbs

Path C:\Users\Admin\AppData\Local\Temp\Autorun.vbs
Size 257B
SHA256 cec2156a84c71ef1d9f1a024b68b29e5d38d2f8725396bd19723e75c7cb6317b
MD5 d1c35608e1592ddfc7ec8334c688ae45
SHA1 84effb46537586059c31b67ced3d5f81f81a2d0b
SHA512 57542401a27a825b48f387519f23a2b95d90ecd55552605475ee44f41c04e4fc335d20b0cc13fc9888d621457ef609c71b4f5c11bb1d062f2c8c9a4089803759
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Roaming\Secure-Soft Stealer\Update.exe
Size 761KB
SHA256 3e088b464ade52e935c9b99f62ca3f490dc777ab2396fddea93d08b213c77abf
MD5 e632d3604cdff042815f2d18859d1fc2
SHA1 47c4732ff3f279c98e426b19e3e910b93f86b8f7
SHA512 3dea9185c079bb8b0ef4fe529814672e91fdde636e21e6bca83fa8b95375f1ee53958ff1751128d21dc21c35871bbc6695d292daab9fb4b88b11885053a668cd
SSDEEP 12288:WCm5RLVrccv5KbK0I5dQW0I1mdjXR/KfUef8Ghcl6ezBSdWQ9FSAHjFy3AOBu5M:WCARLXVV+I1mNw8eftSlLnQ9FXHg3AOG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3840-33-0x0000000010000000-0x000000001005A000-memory.dmp

Download

memory/3840-32-0x0000000010000000-0x000000001005A000-memory.dmp

Download

memory/3840-43-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/3840-41-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/3840-39-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/3840-38-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/3840-25-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/3840-27-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/3840-36-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/4356-3-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/4356-0-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/4356-2-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/4356-18-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/4356-5-0x0000000000400000-0x00000000005BF000-memory.dmp

Download

memory/4356-7-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/4356-4-0x0000000000400000-0x00000000005BF000-memory.dmp

Download