4c6d28d45e6d4c9a338f1b8acf204d23f9913c647004403c340ac515a6a01a74

General

Target

f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
Size

226KB
MD5

f5e620f8a561eb360990e217a6d34506
SHA1

547aee8963c5d5d1e82757cb46e13c5c174a0dec
SHA256

4c6d28d45e6d4c9a338f1b8acf204d23f9913c647004403c340ac515a6a01a74
SHA512

75620aa8273fbcc03c621be9b25d9cbe7fb68302090df392f3af7bef15593a80194263142d0f01c20d372fcb9bd78c01f82c7ed657dce5c9e5ddafdc18e22e03
SSDEEP

6144:lUtlFYUcYVFR4tIf734jZNdR+fVeeM1JhfupmPh:lUfFfcOOpRy0eih2ih

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2552-0-0x0000000000400000-0x0000000000482000-memory.dmp	upx
behavioral1/memory/2552-5-0x0000000000400000-0x0000000000482000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

description	pid	process	target process
PID 2552 set thread context of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 2704 WerFault.exe f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

pid process

2552 f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

pid	pid_target	process	target process
2572	2704	WerFault.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

pid	process
2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exef5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552

C:\Users\Admin\AppData\Local\Temp\f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 260
3⤵
- Program crash
PID:2572

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2552-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2704-4-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2704-3-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2704-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2704-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2704-8-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

description	pid	process	target process
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2552 wrote to memory of 2704	2552	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe
PID 2704 wrote to memory of 2572	2704	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	WerFault.exe
PID 2704 wrote to memory of 2572	2704	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	WerFault.exe
PID 2704 wrote to memory of 2572	2704	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	WerFault.exe
PID 2704 wrote to memory of 2572	2704	f5e620f8a561eb360990e217a6d34506_JaffaCakes118.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads