9be7205d70a04585564a15dcfe057cd8a91c250190d90737da613537bdea1449

General

Target

fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe
Size

184KB
MD5

fb77b787b6b59a5b6e1b7f4b6efc504a
SHA1

2d31ccdf2713623bb6de3bf2028f347014a4212d
SHA256

9be7205d70a04585564a15dcfe057cd8a91c250190d90737da613537bdea1449
SHA512

e2b33ee85ceb99b869ff108ce26d9e03b7ca441d556e7665af26118f699de1b9bacce725b3aff52c77b68ee4b5d55bda3088955cc826ff04a2832ce5799a86f9
SSDEEP

3072:xb8GZwHueA6NP2r1OJsrDLsvsWqmno1PHA1Lfx5fqyB6PID/p5UkgvmODt:xbTK+6A1g8XsDo1PHAH5fKQp53gvv

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3532-1-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/1892-14-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-50-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2180-116-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-122-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-222-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-306-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-404-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-491-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3532-492-0x0000000000400000-0x000000000048E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 1892	3532	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe	86
PID 3532 wrote to memory of 1892	3532	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe	86
PID 3532 wrote to memory of 1892	3532	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe	86
PID 3532 wrote to memory of 2180	3532	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe	97
PID 3532 wrote to memory of 2180	3532	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe	97
PID 3532 wrote to memory of 2180	3532	fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fb77b787b6b59a5b6e1b7f4b6efc504a_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AD46.58F

Filesize
996B

MD5
b64aeb4bc0bac54606e1930238f57bee

SHA1
d620c7f3e12f8e59497b7d97818b4eced7cba501

SHA256
af5d463654c479e6ef3bf5477cfac22b5fe82dd6ee92254079483ae29ab3edaf

SHA512
4ac4d8220d3c1902b3face77705bcebb3e5907110849659bd6cf2a74dcf3c0e4ec21f39cbbb4c89d70536967322875b306fff12e9389ee05e87491c304e48144

Download Submit
C:\Users\Admin\AppData\Roaming\AD46.58F

Filesize
600B

MD5
625a2fe1d8fcd097907e759b3b6740ae

SHA1
90506d779fc81ff4c673d872f4e333be0ca795fe

SHA256
a8a31ba26a7da384c1e15d616f956a76abdae9948212492459e9d8d95272af42

SHA512
356d430e8eff1c0a6dc549ab01ffa2fd83f0ed0c0544bc723b8d67d3ddc8c53873b7976e0466830882a147f26e3e1700e3e4e2a5f438de3c663b2815335afb55

Download Submit
memory/1892-12-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1892-14-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1892-13-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2180-117-0x00000000006A7000-0x00000000006C3000-memory.dmp

Filesize
112KB

Download
memory/2180-116-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-50-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-2-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/3532-122-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-123-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/3532-222-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-306-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-404-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-491-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3532-492-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads