55fb168b837623877c9bea172269e88aba5473ca1e159d70e1b1948202a3838f

General

Target

0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe
Size

156KB
MD5

0c2216c090c6d6dd78e3acd1c716e79d
SHA1

cc6314bab8dd26f5d7f2faccc0cc8515f418fb63
SHA256

55fb168b837623877c9bea172269e88aba5473ca1e159d70e1b1948202a3838f
SHA512

03cc6bf5715db38106180804dd13b88717748d1d87a3417eb7a71d692343b2d9081b263b8024a8dd5877f688d18367a82974b68825bdd998ee435ae088f654de
SSDEEP

3072:HcDImo57Y0K3pu9DTcnhw3bjNlGXpT22qcz3iTiQfUxBhod2oZd6GI4XnC/+w4we:89MtVJTA2NqT2PTTfUxBUZMr43m+FF

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-1-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2336-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2336-4-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1704-14-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1980-90-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1980-91-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1704-92-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1704-188-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2336	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2336	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2336	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2336	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	28
PID 1704 wrote to memory of 1980	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	30
PID 1704 wrote to memory of 1980	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	30
PID 1704 wrote to memory of 1980	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	30
PID 1704 wrote to memory of 1980	1704	0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0c2216c090c6d6dd78e3acd1c716e79d_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\88B7.5C4

Filesize
600B

MD5
3bc3bfd044435f02d1b07ad4dfc7ea7f

SHA1
9b43ccf80202144cce50216650472044a6b0c678

SHA256
27108bb931bde17070a819c5fc3494259503708a9ad28c9f1426cf816900d23a

SHA512
77adf5441740ad67cb589d5dafd3ccc4e481472a8d13fc33d3e65013811d18db5e869f4f4b4f8081e57c2e5ed25d558fd316f04186ca686a0fca40e6179c20e6

Download Submit
C:\Users\Admin\AppData\Roaming\88B7.5C4

Filesize
996B

MD5
cffb6ed57ace20e8245378509f98d039

SHA1
7bd02496bbcc05ce6779ff936d08dc460af4f124

SHA256
c8de3b15f69f0da252f3664971525b29ad1a1df289effe99b06bfe3c7d10430e

SHA512
eb8009cc2b8931bf4dd90540e7ca1d650169588ce90e177e1794261e56132c9d5f4cef3ce1e70c7cd9b77164b0d443738b68e8a71ebd789766e0762e49358363

Download Submit
memory/1704-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1704-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1704-92-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1704-188-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1980-90-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1980-91-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2336-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2336-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads