b4bf2e9e3f3cddca63a753968138825c9959b0f22d49842509bc6efb2298c9d3

General

Target

05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
Size

93KB
MD5

05e64033d73526d239c4b1f06a0fccd5
SHA1

1090a6a1f999b34d3ae8e4953912a20f38c463d6
SHA256

b4bf2e9e3f3cddca63a753968138825c9959b0f22d49842509bc6efb2298c9d3
SHA512

d5cbade4be78d9c3965a3fc4102a033015cf987ec824ed79475b1867c2571e3080c6285a055d7b0bfb0e059ed8415868566258c7dd34321528930d71d146860f
SSDEEP

1536:UGjS/jdLRqInfX2D/LDsFCTnSrtSJvU3cyBOO/dh6q6ufTDf4:UGjSLdl9fXILwF2n1Jv6hp6unQ

Score

7^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Swcurpn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\2etl\\Swcurpn.exe /Klaunchp"	Swcurpn.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Swcurpn.exe

description	ioc	process
File opened (read-only)	\??\r:	Swcurpn.exe
File opened (read-only)	\??\u:	Swcurpn.exe
File opened (read-only)	\??\y:	Swcurpn.exe
File opened (read-only)	\??\a:	Swcurpn.exe
File opened (read-only)	\??\g:	Swcurpn.exe
File opened (read-only)	\??\i:	Swcurpn.exe
File opened (read-only)	\??\n:	Swcurpn.exe
File opened (read-only)	\??\p:	Swcurpn.exe
File opened (read-only)	\??\z:	Swcurpn.exe
File opened (read-only)	\??\e:	Swcurpn.exe
File opened (read-only)	\??\k:	Swcurpn.exe
File opened (read-only)	\??\t:	Swcurpn.exe
File opened (read-only)	\??\v:	Swcurpn.exe
File opened (read-only)	\??\w:	Swcurpn.exe
File opened (read-only)	\??\h:	Swcurpn.exe
File opened (read-only)	\??\j:	Swcurpn.exe
File opened (read-only)	\??\m:	Swcurpn.exe
File opened (read-only)	\??\x:	Swcurpn.exe
File opened (read-only)	\??\b:	Swcurpn.exe
File opened (read-only)	\??\l:	Swcurpn.exe
File opened (read-only)	\??\o:	Swcurpn.exe
File opened (read-only)	\??\q:	Swcurpn.exe
File opened (read-only)	\??\s:	Swcurpn.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exeSwcurpn.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
File opened for modification	\??\PHYSICALDRIVE0	Swcurpn.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Swcurpn.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Swcurpn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Swcurpn.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Swcurpn.exe

pid process

1396 Swcurpn.exe
1396 Swcurpn.exe
1396 Swcurpn.exe
1396 Swcurpn.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe

pid process

116 05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe

pid	process
1396	Swcurpn.exe
1396	Swcurpn.exe
1396	Swcurpn.exe
1396	Swcurpn.exe

pid	process
116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exeSwcurpn.exe

description	pid	process
Token: SeDebugPrivilege	116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
Token: SeDebugPrivilege	116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
Token: SeDebugPrivilege	116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
Token: SeDebugPrivilege	1396	Swcurpn.exe
Token: SeDebugPrivilege	1396	Swcurpn.exe
Token: SeDebugPrivilege	1396	Swcurpn.exe
Token: SeDebugPrivilege	1396	Swcurpn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exeSwcurpn.exe

pid process

116 05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
1396 Swcurpn.exe

pid	process
116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
1396	Swcurpn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe

description	pid	process	target process
PID 116 wrote to memory of 1396	116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe	Swcurpn.exe
PID 116 wrote to memory of 1396	116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe	Swcurpn.exe
PID 116 wrote to memory of 1396	116	05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe	Swcurpn.exe

C:\Users\Admin\AppData\Local\Temp\05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05e64033d73526d239c4b1f06a0fccd5_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116

\??\c:\2etl\Swcurpn.exe
launch
2⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/116-1-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/116-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/116-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/116-20-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1396-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1396-13-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1396-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1396-25-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads