9faf200b2af8f6d1775d12bf24293d717fdf062adb097711ba2d0cfe984e0d11

General

Target

3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
Size

1.8MB
MD5

3e0319fa23e5878346e575917f24f575
SHA1

023684c51ba2925edabdd20dbfe817638a7f95e7
SHA256

9faf200b2af8f6d1775d12bf24293d717fdf062adb097711ba2d0cfe984e0d11
SHA512

a6229258c605b2c721639d6fc6411824798d8038441644e11be7a4bfe7097954caf94fc48c797a72552afb81381e6b26c0e77fa406a29eee662a7d0e4954ca50
SSDEEP

49152:TS8XXzOcR+0OLDR/ErO1y6m+qfjBPKx5yBSnFyrg40GPzE:T5ScULDerj+Mj1Kx5yBSF4g4dPzE

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1196-0-0x0000000000760000-0x0000000000AC6000-memory.dmp	upx
behavioral2/memory/1196-332-0x0000000000760000-0x0000000000AC6000-memory.dmp	upx

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpkgdalmnhlpcmhcdegjmnljhjbbpojo\27.0.0.1_0\manifest.json	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
1196	3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e0319fa23e5878346e575917f24f575_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
a0f88fbab8eabc163168dbe970192f7f

SHA1
1ef31a22d8e186d6a76326e22ef1e6696e1e78e4

SHA256
ec85020c32aeaf57eb98ce29b990a606de4607d628e3f49f99e3bc9acdc4ba4e

SHA512
80572e4058d30b96310c50d7375d3b70e30465e5435f69a109a08e50327d508177e344ee6431b4ea1ea7df26dbf7393867e7244d58fe55f2fc9a389740afdbdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\123.zip

Filesize
174KB

MD5
0352cc12c307470c5c1e169fd968ce92

SHA1
22615fb7c792cd4088abd29f592c3a5b7a032604

SHA256
1ab3c673aee22460239eb689a8635a188dc6863471818b65e2483aad11dbda8f

SHA512
998ff9fdd0a98b9f7dd7efaf6704d4e862da773fc4e7057ab92d560726a5cb728708a88622eb337cbea24deb044df770f45e45fe1cf2ff26f94cd454abc3f4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\calc.dll

Filesize
290KB

MD5
7677a8f58a62fff9386fd90482ac99dc

SHA1
42c1a86ec1cff33e9d28f1ab1e8a77c9d4b01bd6

SHA256
6940bd1488f22a0343d9b38715027f2faf69f9a562031ba7f0015ebfeb307351

SHA512
eb0f612194056fd3c1cc09a9350a7f904510213d0db99caf3cbac8aa64e4bcfbf07cb8321caec550101ffe9d5371da7d87217729b76c312acbad0afa8ab248f6

Download Submit
C:\Users\Admin\AppData\Roaming\Baidu\BaiduBrowser\user_data\default\chrome_profile\Extensions\cffnkbinlcdhgmibbfcmjeidphonnang\1.0.0.1_0\images\logo96.png

Filesize
2KB

MD5
f44c4827ae250b049e11c94ccfcc9794

SHA1
a2c4d65c976dbdbdf9bb6ea5784658f7f6d45726

SHA256
0928e6b68f332891b345fc6595f8598b5f2a88c449e79a1604f486df0435422e

SHA512
3ef11e91405883b0e644a8339cade85dc65044616a1e780dfa99c70043770f3682218fe220f72daee98e6c94a681b740a1545c82ae34e019cd3d0569218f2d8e

Download Submit
C:\Users\Admin\AppData\Roaming\SogouExplorer\Extension\cffnkbinlcdhgmibbfcmjeidphonnang\1.0.0.1\sgex.db

Filesize
53KB

MD5
d0eb6498b195cea16aa9b521e377eaf0

SHA1
4f9f59fb59d5df2bd78bd1677c7a77a967277ec4

SHA256
c195de55553a69ecc896fc85dea2ec77ac44171e6b38e4f8e144c65d26a4edc1

SHA512
346e81dc444eb9a633870ca7370764b81d481c5fc1acd6b9b563d02a6fddf426fedffc94a178d6d682e86ba0a57f9ba60e28a0eb6ad27c7e4866c2a44eeb836b

Download Submit
C:\Users\Admin\AppData\Roaming\SogouExplorer\Extension\cffnkbinlcdhgmibbfcmjeidphonnang\1.0.0.1_0\pluginfos.json

Filesize
3KB

MD5
1f2caa3b5de2fdb1c746b06ededb1624

SHA1
db0b92b45ceccde7dc091f76f8f91f574272896e

SHA256
c96896655164e08b88aa20571eedd6cc6bc14723a0b656832266e180e783300e

SHA512
493e5cd308eb45618805b76e21d7419c61c8b74457d54120d15efa0abc6928c4cfb7e6b3a06be9a8ef4b7579425e339ef7af3f307a1caacaf1795f8ab28641d5

Download Submit
memory/1196-0-0x0000000000760000-0x0000000000AC6000-memory.dmp

Filesize
3.4MB

Download
memory/1196-6-0x0000000010000000-0x0000000010076000-memory.dmp

Filesize
472KB

Download
memory/1196-332-0x0000000000760000-0x0000000000AC6000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing