0ba6333e2f21f5a1559c3a2b3d363f336b93eac4a6a31b08b899621e5b39099c

General

Target

1a9b9af755538f531316e9c111418866_JaffaCakes118.exe
Size

11.2MB
MD5

1a9b9af755538f531316e9c111418866
SHA1

be72b69c47971fda0e453453de20a2742a27144b
SHA256

0ba6333e2f21f5a1559c3a2b3d363f336b93eac4a6a31b08b899621e5b39099c
SHA512

2f1a96e412797023932550acce4476b09c0cd2dea41e8d52c4882fb0f5055fa32471dff15204b1ea54f7cd3a2fe34aaefad7e030f0584399a2ba6dfad797591b
SSDEEP

196608:t/Dm+89/7/lthjzRHORtLpKkcT2qFOjB4SI9gp3RhsduVHTIawZUw94dC3Ibu4WB:tb9MuRtLKahl8gpBYu5m94Q3f4W0U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp
2800	APNStub.exe

Loads dropped DLL 6 IoCs

pid	Process
1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe
1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp
1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp
1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp
2800	APNStub.exe
2800	APNStub.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1644 wrote to memory of 1184	1644	1a9b9af755538f531316e9c111418866_JaffaCakes118.exe	28
PID 1184 wrote to memory of 2800	1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp	29
PID 1184 wrote to memory of 2800	1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp	29
PID 1184 wrote to memory of 2800	1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp	29
PID 1184 wrote to memory of 2800	1184	1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp	29

C:\Users\Admin\AppData\Local\Temp\1a9b9af755538f531316e9c111418866_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a9b9af755538f531316e9c111418866_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\is-AOHSU.tmp\1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AOHSU.tmp\1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp" /SL5="$40112,11426140,54272,C:\Users\Admin\AppData\Local\Temp\1a9b9af755538f531316e9c111418866_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\is-FA3U3.tmp\APNStub.exe
    "C:\Users\Admin\AppData\Local\Temp\is-FA3U3.tmp\APNStub.exe" /tb=KSO
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-FA3U3.tmp\APNIC.dll

Filesize
174KB

MD5
016b4cb0f363e8563ae9d4c97189ae5d

SHA1
1eff205d7d0d82baf841a98c176d700114e13fe6

SHA256
c07ad5ccb030fc1d4c950c63fa6d01976222e437b356f0e0ccbf625a3414735a

SHA512
d21c739b0c60057cec944acdf049f513bae5e502f67c99012f837a4ceab5088c2a98d151ff66eb1472bf329a586a25a45c8643c8a8642454491752875c9aff61

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FA3U3.tmp\APNStub.exe

Filesize
105KB

MD5
23ee55d0c183cc6e85c8fb97fb5973e8

SHA1
1a99d3266ce87fb2164e1153b4fd5815ac71dedc

SHA256
1696415e21f97128683de57bc8e159b2c076577595416b50769a006c531007e5

SHA512
b8b74d3c6decde5cff3d0d022cc65f00a5ce99f8af4ddb31c2f3b435675e0ef0f35917709b0b7ee4339918e416bfbfcabd39c2321d036a4841ac2ac389eab623

Download Submit
\Users\Admin\AppData\Local\Temp\is-AOHSU.tmp\1a9b9af755538f531316e9c111418866_JaffaCakes118.tmp

Filesize
693KB

MD5
1a2c24d78c5f645ee6a778061d38798a

SHA1
ad22aa1a5a47334e21be3bfbc199d9fc16666c12

SHA256
eac4f89141538d2780927ac79c650ea441707cfc41360902af23db650f264682

SHA512
f543e17ce7f7a5aaa568d39d98ceb453c008703169524468d8e01a47db0096bdaabc81450adc6a5995661af3eb89aac50549c89c49ce1c313851bfc8be4749fd

Download Submit
\Users\Admin\AppData\Local\Temp\is-FA3U3.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1184-8-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1184-25-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1184-51-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1644-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1644-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1644-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing