286c8d67eac594e9b15b554607c9c8a9a3c72cc99c0d7a62e15b74c9ec5a3253

General

Target

0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
Size

164KB
MD5

0df3318d819d9ad6ebd2a967f1e98813
SHA1

5072f8aed37a42d820ba58472dfc48ba02dad908
SHA256

286c8d67eac594e9b15b554607c9c8a9a3c72cc99c0d7a62e15b74c9ec5a3253
SHA512

2a1366573abcea264470ef34a1c38319db5d65d9260943751943571bd18ba84fc6768d9453b37be8aed843039ff5fff8f365b7fa9fe425d45051207668e3a501
SSDEEP

3072:h8JoE0ABLF7U9/IjKZcg3T4pxyLaQFiAXCgRdAesXGDQghH/cE:UiWFGcg6AiIRuBXAf

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\956CA\\FEB07.exe"	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-3-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2220-2-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/3008-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/3008-15-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2220-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2756-136-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2756-135-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2756-138-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2220-139-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2220-251-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2220-302-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3008	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	28
PID 2220 wrote to memory of 3008	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	28
PID 2220 wrote to memory of 3008	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	28
PID 2220 wrote to memory of 3008	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2756	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2756	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2756	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2756	2220	0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe startC:\Program Files (x86)\LP\07B9\C21.exe%C:\Program Files (x86)\LP\07B9
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118.exe startC:\Program Files (x86)\CA4E5\lvvm.exe%C:\Program Files (x86)\CA4E5
  2⤵
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\956CA\A4E5.56C

Filesize
996B

MD5
26d24fb5cbded556ccdfe377d4b46754

SHA1
ee4fe81c5a62e9a5af71fb4fc0a816ce1050d523

SHA256
f904cc7c71d18182a66ebfb5e0f7a80d49d263e71c6dfbdd973fdbf63bb1ed61

SHA512
f98185e8675d2570941d539e9bc656a102eddc9847d99a1ee354605711ca0b5bb49d453db335b6bde837cbc80228760af8214b97d8dec0b9439c8003e089cf55

Download Submit
C:\Users\Admin\AppData\Roaming\956CA\A4E5.56C

Filesize
600B

MD5
33c90a26f5aa16229561706fed173672

SHA1
b77b30d6e2875df6314324c6d09ed9c882768b12

SHA256
dee2b92159806ac8e3d534c9d9f81076ddcd282f44e68cd071a2707e2aaf3820

SHA512
5274fa97a0fd1ac206f3db3678339bceebc38849468dad41e5ed758fd49143def32cf857e0b69d3f5438f3086ec3bddabbb662cf02e0f4807311e72787768a5b

Download Submit
C:\Users\Admin\AppData\Roaming\956CA\A4E5.56C

Filesize
1KB

MD5
c0fb9c208e6c8cff8addb694faaa102b

SHA1
448a9ed7a99c8479a81e5bd3c57dcc06c8343960

SHA256
14f88feb09d625f7f6cb1f074015cd30ca5e0611a95fe34280760adf52956c47

SHA512
8079b474064b21f230f4d5e3f408d0aa388ca52ec385f1878d4ea3889733fa2cfd90216d7f6b2e25df2676cd82ee6fc51eba428b7019fbee190bdecd5a0187dc

Download Submit
memory/2220-139-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-3-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2220-302-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-251-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2220-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2756-136-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2756-138-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2756-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3008-15-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3008-16-0x00000000006C6000-0x00000000006DA000-memory.dmp

Filesize
80KB

Download
memory/3008-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads