9cf446d05c5d1c0d9056f0fb3023397b09dfc299a51e9c282958ae083c0e894f

General

Target

18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe
Size

164KB
MD5

18d4360bdb5c027080cb0b2ad6029a0e
SHA1

fae43f8758dd0c516d61fb0bc3a35987a0d9e9ac
SHA256

9cf446d05c5d1c0d9056f0fb3023397b09dfc299a51e9c282958ae083c0e894f
SHA512

792570de0fbe423b069f0c9de95f918f30982409033d71ef5ab4d1f2e96dd518d1b680334653014eff397aede203e2ba929fc8643b3298836780071ce5684d63
SSDEEP

3072:4/X8qNV76jgrW2nWnqgLU/mLwITxm8KU/CaGVul46PcL76SAN:usqT7CgrZPgL5wexm6VlgvA

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\A20D2\\3A235.exe"	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-3-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2256-4-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2464-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2464-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2256-17-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1324-135-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1324-136-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2256-138-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2256-250-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2464-252-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2256-298-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2464	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2464	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2464	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2464	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	28
PID 2256 wrote to memory of 1324	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	30
PID 2256 wrote to memory of 1324	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	30
PID 2256 wrote to memory of 1324	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	30
PID 2256 wrote to memory of 1324	2256	18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe startC:\Program Files (x86)\LP\359A\E27.exe%C:\Program Files (x86)\LP\359A
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Local\Temp\18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\18d4360bdb5c027080cb0b2ad6029a0e_JaffaCakes118.exe startC:\Program Files (x86)\D2AA4\lvvm.exe%C:\Program Files (x86)\D2AA4
  2⤵
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A20D2\2AA4.20D

Filesize
600B

MD5
7f053957e9c026e0b31717475e6fa6d0

SHA1
fb5207adf1ad05ddfae05e473ea3e3ab2b07e116

SHA256
c9ca4f50d94441d2c72f9fa28d0c61481573b86a85d4955225c8188754b18c82

SHA512
f245b1d54afdfacc98af78f44cdf6d690cfdedebca4ec43b8ba74861fa9437e4e9da141e43e3a1a6ebbef519c43460b7b73b9451d97d43931f76eb4a782d9aad

Download Submit
C:\Users\Admin\AppData\Roaming\A20D2\2AA4.20D

Filesize
996B

MD5
82248e07dacc791098263c5d3bfa9338

SHA1
525ea9ea1d0d16f56c2f1d2f69dd9c0ec80067bf

SHA256
d5ba334b8d9e9ce2aa2849bef194af44ff4194b6ab8f8c781062bf259b5f9645

SHA512
48be42811e52ed63c59e9303e14eed8658598ed02ed65142480677e6c070c36963336aae2e52d196cf4d47381704d7b8aefdd6464173fc7b73c22fa37af77f1a

Download Submit
C:\Users\Admin\AppData\Roaming\A20D2\2AA4.20D

Filesize
1KB

MD5
130c466650442ca95d25b6be9d77c12d

SHA1
eb34e636605c45281c2f66fbc0545ff31c58fc2d

SHA256
1221c35c4a426813855896d92c87fdc3dcba158721722384aedf48ae3d103015

SHA512
68263d04d65fc1f629ec9bef3ba9ba5a72ff771ab070c0b56af2ae8de260fce47c3ea1cb78f31f924f3a5c5e24fb03862527643ac9c7b92e6075f770775ae52a

Download Submit
memory/1324-137-0x000000000027C000-0x0000000000291000-memory.dmp

Filesize
84KB

Download
memory/1324-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1324-136-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2256-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2256-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2256-138-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2256-4-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2256-3-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2256-250-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2256-298-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2464-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2464-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2464-252-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads