01da3048dab88645c28f89a20f85ecdb9696028be7b05cfd41dfef53b7623dfb

General

Target

17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe
Size

191KB
MD5

17e64f6652e561c98a755ee2d65858c1
SHA1

c22c4ee3b7f1d28a12d34dbaceda2d757d92d21d
SHA256

01da3048dab88645c28f89a20f85ecdb9696028be7b05cfd41dfef53b7623dfb
SHA512

788b49a2bc20a91071ff4bd2a4544213996358aa01e48efac73fc2327e67f9cb8625fc9b1b98c2bf1364da75dca2bc635676f3f15b652e6ad63a844a9a782684
SSDEEP

3072:vH8PiU4MMRHR3Sosv17FZa1evY6phG7M9pJ/mCT+CSpGiqAk4ON:vZUDMRxvsvA1QYikM3J/mCTaPq

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2380-4-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2692-80-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2128-82-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2128-151-0x0000000000400000-0x000000000046A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2380	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2380	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2380	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2380	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2692	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2692	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2692	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2692	2128	17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\17e64f6652e561c98a755ee2d65858c1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CD8F.B37

Filesize
300B

MD5
13192b283d8df44dfb8428604e55101e

SHA1
484fd6baa88bc05196a2d5fcba207fc69ef0c13b

SHA256
c7678610a6f716b1a752d891bd284dc456d74bfb14a0fd5637556c43353c4526

SHA512
b2147f49bb5ad6ff9157fbdebacd7a6e8ffa795b49d33b6c7a3ee29c0c91e75cd6c1b7d53d75e4b4f4687bc2ed6becd1b3ed8eb0041ede4bea4fe0771de2839d

Download Submit
C:\Users\Admin\AppData\Roaming\CD8F.B37

Filesize
1KB

MD5
1e8d9b41d909e2ff0a41339b486d9d94

SHA1
aa9b801fd996db130cd46e77adfe39b0e75d74ac

SHA256
92987e13e99ad604567e248588796154a6bd206607e800b1beb4f6eb3303c7f3

SHA512
36a587b33f7e4a2bfaec0aedc2439e85f8351c955f1bc84913db38eb1f695525d727b2c943ab450212b95a29414c3f7f785718236d5ca4d5f375438e26f15e7e

Download Submit
C:\Users\Admin\AppData\Roaming\CD8F.B37

Filesize
600B

MD5
e5dfcbcfa6c16d0adbf2d49c2e3106ff

SHA1
9af32d1f0f925d09695240ae5dc06790c0b19a1e

SHA256
45bc4b7f2aaf1e409c304a4b34ce8b8681bab3ee50e92ac0f8c648355b5c257d

SHA512
e9d1b4149e882b88929704aecbd025eb263a6e9fe2e0a2c14e46234aaca11d731ab4ee50d1d892986520b553d488c76e2fa5ed3fe3e29dab893c3cf670bf572a

Download Submit
C:\Users\Admin\AppData\Roaming\CD8F.B37

Filesize
996B

MD5
e813bd56692c7364e05380ae26fb7822

SHA1
b602765c90bbe30544bab82756502f11a67ff2d9

SHA256
38aedb3428aa19089052571304ae6ed5f00cfb4ab6a47d804ec97a8c90ef0cbf

SHA512
797f28d9bf0cddc9455fcfe75222bdff031f041f3b4cbc3726c03064a03116cf22378d97a57a890ba6a7d37f4d7148064efc0bff835375a42d5951b3df700a3a

Download Submit
memory/2128-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2128-82-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2128-151-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2380-4-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2380-5-0x0000000000564000-0x000000000058C000-memory.dmp

Filesize
160KB

Download
memory/2692-80-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2692-81-0x0000000000604000-0x000000000062C000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing