575cdfb73fd50c96e02bb5ca12c9952ec6d2f20d5f0bd0122e50bdc9c3188494

General

Target

100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe
Size

103KB
MD5

100ffe414f502d33242ab15ee9ee014f
SHA1

92fdd7e5fdec7f25d35a62ae8f58f7b32372fbdd
SHA256

575cdfb73fd50c96e02bb5ca12c9952ec6d2f20d5f0bd0122e50bdc9c3188494
SHA512

4e320c7afa18c03c585d4a40097fb19c05721cba981a86574793ff47cfe8ae1e7cade016c5ce93610d7eae55e8b32ceb1c4b1f4899197fff32261db3a3f63c2e
SSDEEP

1536:IjZHmWDvgCOwKJG1QPw3zVMqPflrGy0tDK+wee5T2L7GFdg1yJU1YPoPRyFnug2j:IjtmWDvgCOw2O0w3tR7+Ao0JUeAEc

Score

10^/10

discovery spyware stealer

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
my-onlinetv.ucoz.ru
Port:
21
Username:
0my-onlinetv
Password:
819711z

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe
4516	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81
PID 1860 wrote to memory of 4516	1860	100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\100ffe414f502d33242ab15ee9ee014f_JaffaCakes118.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-7-0x00000000020A0000-0x00000000020B0000-memory.dmp

Filesize
64KB

Download
memory/1860-4-0x0000000002060000-0x0000000002070000-memory.dmp

Filesize
64KB

Download
memory/1860-15-0x0000000002130000-0x0000000002140000-memory.dmp

Filesize
64KB

Download
memory/1860-9-0x00000000020C0000-0x00000000020D0000-memory.dmp

Filesize
64KB

Download
memory/1860-6-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1860-14-0x0000000002120000-0x0000000002130000-memory.dmp

Filesize
64KB

Download
memory/1860-13-0x0000000002100000-0x0000000002110000-memory.dmp

Filesize
64KB

Download
memory/1860-12-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/1860-11-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/1860-10-0x00000000020D0000-0x00000000020E0000-memory.dmp

Filesize
64KB

Download
memory/1860-16-0x0000000002140000-0x0000000002150000-memory.dmp

Filesize
64KB

Download
memory/1860-5-0x0000000002070000-0x0000000002080000-memory.dmp

Filesize
64KB

Download
memory/1860-3-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/1860-2-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/1860-1-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/1860-0-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/1860-8-0x00000000020B0000-0x00000000020C0000-memory.dmp

Filesize
64KB

Download
memory/4516-21-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4516-19-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4516-22-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4516-29-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing