c13f2e45e6ed0eee8e08a7664e8227a8edcce6103f48a0c8523f6539c42adb84

General

Target

02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe
Size

110KB
MD5

02e454d3b9f7082fee853334563a9b57
SHA1

176097a865d46ce0b1351e4e57f0fd47e340edc0
SHA256

c13f2e45e6ed0eee8e08a7664e8227a8edcce6103f48a0c8523f6539c42adb84
SHA512

01b6629e42173a698acefc8a84111daaac86bdcc7bf5ef48caf274f07311abe61c3565c225791973fbd4e7449bad1c1224b35b504dc61d0b4be003a09c035150
SSDEEP

1536:GdYBBBMFKj9RWs0MQd4rCC6JGPSjfc9ocZXfuI8Immb8VoQ33/K3WheP+YOWa2as:DBMFKzf84r6J/cWcNWyrYCF3/P+YOE

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

12CCE00E511F47E58588D.exe

pid process

2144 12CCE00E511F47E58588D.exe
Loads dropped DLL 2 IoCs

Processes:

02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe

pid process

3040 02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe
3040 02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2144	12CCE00E511F47E58588D.exe

pid	process
3040	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe
3040	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000400000-0x0000000000447000-memory.dmp	upx
\Users\Admin\AppData\Roaming\12CCE00E511F47E58588D\12CCE00E511F47E58588D.exe	upx
behavioral1/memory/2144-14-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\12CCE00E511F47E58588D\\12CCE00E511F47E58588D.exe"	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

12CCE00E511F47E58588D.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	12CCE00E511F47E58588D.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

12CCE00E511F47E58588D.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	12CCE00E511F47E58588D.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

12CCE00E511F47E58588D.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	12CCE00E511F47E58588D.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe

description	pid	process	target process
PID 3040 wrote to memory of 2144	3040	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe	12CCE00E511F47E58588D.exe
PID 3040 wrote to memory of 2144	3040	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe	12CCE00E511F47E58588D.exe
PID 3040 wrote to memory of 2144	3040	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe	12CCE00E511F47E58588D.exe
PID 3040 wrote to memory of 2144	3040	02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe	12CCE00E511F47E58588D.exe

C:\Users\Admin\AppData\Local\Temp\02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02e454d3b9f7082fee853334563a9b57_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Roaming\12CCE00E511F47E58588D\12CCE00E511F47E58588D.exe
"C:\Users\Admin\AppData\Roaming\12CCE00E511F47E58588D\12CCE00E511F47E58588D.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:2144

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

4

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\12CCE00E511F47E58588D\12CCE00E511F47E58588D.exe
Filesize
110KB

MD5
02e454d3b9f7082fee853334563a9b57

SHA1
176097a865d46ce0b1351e4e57f0fd47e340edc0

SHA256
c13f2e45e6ed0eee8e08a7664e8227a8edcce6103f48a0c8523f6539c42adb84

SHA512
01b6629e42173a698acefc8a84111daaac86bdcc7bf5ef48caf274f07311abe61c3565c225791973fbd4e7449bad1c1224b35b504dc61d0b4be003a09c035150

Download Submit
memory/2144-14-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2144-17-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/2144-18-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2144-21-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/3040-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3040-2-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/3040-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads