8f80835cb9d369e599e4a1992f948b4bed108f74b47ae3a90da360fa1609acca

General

Target

063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
Size

1.0MB
MD5

063ce2b4899e742b8c0f078bdcb6d6be
SHA1

09496fb14005fa2d08e8687f0e2cd77752a62cf4
SHA256

8f80835cb9d369e599e4a1992f948b4bed108f74b47ae3a90da360fa1609acca
SHA512

74122ea8d875bea1787aa7bf6eec38937a2398d49524f4f81499a55f08ee205535c48b66407fee0caf34b8add967b88765883432732bf0cc8b31aea9931c3638
SSDEEP

24576:2oa9YyDOt81++IqQbTStuQTrensKDvJyEF2RzfCCGsSKG:2oa9RDo81i6IQen7YEYdCxfJ

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2940-19-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-18-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-21-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-22-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-25-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-24-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-23-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-26-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-27-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-29-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-30-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-32-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-31-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-33-0x0000000000400000-0x0000000000645000-memory.dmp	upx
behavioral1/memory/2940-38-0x0000000000400000-0x0000000000645000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe"	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

description	pid	process	target process
PID 2868 set thread context of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

pid process

2868 063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

pid process

2868 063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
2868 063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

pid	process
2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

pid	process
2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
2⤵
PID:2460

C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
2⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
2⤵
- Adds Run key to start application
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x0000000000400000-0x0000000000400000-memory.dmp

Download
memory/2868-1-0x00000000003A0000-0x00000000003A4000-memory.dmp

Filesize
16KB

Download
memory/2940-3-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/2940-7-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-16-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-15-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-13-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-10-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-9-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-5-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-17-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-19-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-18-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-21-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-22-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-25-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-24-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-23-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-26-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-27-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-29-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-30-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-32-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-31-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-33-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/2940-38-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download

description	pid	process	target process
PID 2868 wrote to memory of 2460	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2460	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2460	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2460	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 3052	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 3052	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 3052	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 3052	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe
PID 2868 wrote to memory of 2940	2868	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe	063ce2b4899e742b8c0f078bdcb6d6be_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads