6161fdcd2661f9efc02f4a59e8f3ef25853d6a10b618e9acca6d0a5cb9a3e70d

General

Target

0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe
Size

172KB
MD5

0f31c15f68f9bf7acd95d4808990f11c
SHA1

d535c67a6938c2baef9a2e495bceb0f71c762622
SHA256

6161fdcd2661f9efc02f4a59e8f3ef25853d6a10b618e9acca6d0a5cb9a3e70d
SHA512

aa726e1fd1baa8cc8e774b2be9ef99174d176dc76737134e08449b152e1fe6f9baa8f87eacd25877326545169d70b6918b387aabddb3bbb1c6e9e7471cd2b575
SSDEEP

3072:IUWU+9KHAF7i873mvGgUrjjC27P1mPqcdw2f1M+S3oMdT//0cYdL7yetlp:nWUWKgV3WJqb7PMHdpEoMdYFvJtr

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\8983A\\CCED3.exe"	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1932-2-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1932-3-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1588-14-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1588-15-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1932-76-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/3004-83-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1932-85-0x0000000000400000-0x000000000048D000-memory.dmp	upx
behavioral1/memory/1932-183-0x0000000000400000-0x000000000048D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1588	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1588	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1588	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1588	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	28
PID 1932 wrote to memory of 3004	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	30
PID 1932 wrote to memory of 3004	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	30
PID 1932 wrote to memory of 3004	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	30
PID 1932 wrote to memory of 3004	1932	0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe startC:\Program Files (x86)\Internet Explorer\D3A8\2EF.exe%C:\Program Files (x86)\Internet Explorer\D3A8
  2⤵
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0f31c15f68f9bf7acd95d4808990f11c_JaffaCakes118.exe startC:\Program Files (x86)\3AED4\lvvm.exe%C:\Program Files (x86)\3AED4
  2⤵
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\8983A\AED4.983

Filesize
1KB

MD5
85040840e90acad01154c8859d7b2d7e

SHA1
fd7e0f5de6eba0af8541ab882270c9b5ed932412

SHA256
7672efe7c79779a9dc83de7593d323a7231a16b1b32871a9a518ff8be1a094db

SHA512
868cb1e0fcb833108af64de39e71e0ba7147ba69158fcd7bd68ddc41bfa69188ba3e6ff179d8bc88c69b504b2e7c2d06603cb289fc4d8b13a3c49e71cda6a211

Download Submit
C:\Users\Admin\AppData\Roaming\8983A\AED4.983

Filesize
600B

MD5
80e79739c6746dbb436cbcfbc131398a

SHA1
f75d8d5bdfcdaea2509468c635638b4f5aed3e1a

SHA256
f1173ff84e3abfa89c7f7702492461c198461edebbb40b16445a2be98f486da4

SHA512
5799b71d3b30aa6f777ea53b411f72dcc6753366b9928038f1c6aa6aabd7516aa46079862f5d29da4a3d8387b6464104522c1d4ae71966c417f7db60f0fbe8f0

Download Submit
C:\Users\Admin\AppData\Roaming\8983A\AED4.983

Filesize
996B

MD5
689d085923d42887c265eb894a8f7e21

SHA1
f559f9c1632857e25ec5c792a83e1faf28bf8ee9

SHA256
8261093d770ea138c31c8a36db3f1d55b6cb435dfee568a4e41eb929c06d53c5

SHA512
3e4ca36a41e2508f41d63b58f0ab879bd422b2e1b28e11733431e11c4dcde3866da876d1478c4eb7871a2b1d8a882a408926e95ca3935f8789f620ff0de4e8d4

Download Submit
memory/1588-14-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1588-12-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1588-15-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1932-76-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1932-85-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1932-2-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1932-3-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1932-183-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3004-84-0x0000000000607000-0x0000000000620000-memory.dmp

Filesize
100KB

Download
memory/3004-83-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads