3687b93e3ae961dea1dc491d5cfd2b50852f85aaccf9c90de426cf745ef19d28

General

Target

1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe
Size

155KB
MD5

1c2e06d10cb4c71b42ef5a9a6636d36e
SHA1

76996f27484fb060841e4be70fdc5ebe8dd3dd56
SHA256

3687b93e3ae961dea1dc491d5cfd2b50852f85aaccf9c90de426cf745ef19d28
SHA512

1ea250c2c0a6e333629338e02a435458613973ffdd1e6774939a3db2454516302513fc194eacfca94d5a759c1ee535b1d277e896c2e0b8108c67d9d0761bcebd
SSDEEP

3072:5hPPXDsqYl/7kOXKoiEMwxXPQLyoAmkfkO8YO/m5GVwYLw:5ZDsqm7kuK7EMwayFmwk7Y/v

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1320-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2416-6-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2416-8-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/2836-89-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1320-91-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1320-189-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2416	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	28
PID 1320 wrote to memory of 2416	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	28
PID 1320 wrote to memory of 2416	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	28
PID 1320 wrote to memory of 2416	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	28
PID 1320 wrote to memory of 2836	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	30
PID 1320 wrote to memory of 2836	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	30
PID 1320 wrote to memory of 2836	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	30
PID 1320 wrote to memory of 2836	1320	1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1c2e06d10cb4c71b42ef5a9a6636d36e_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\5F1F.3C5

Filesize
297B

MD5
35da9f5c37499d982665a6d0bdb7c73e

SHA1
2fc23730ecd5348b34009b4fc0c67ee5a0d5718c

SHA256
acb4f74c92e9e25e36db69140cb0a931ef3e78ee856e42a6c4f9647df60d1e07

SHA512
556d3f326a7ee29e57341bef71f2acd4365117b2cf233e6bea102be9fb6c83904c9392cb739b2840bdd96e51d0cdbea7678f0f4b1695faf79de0d1731a73dabc

Download Submit
C:\Users\Admin\AppData\Roaming\5F1F.3C5

Filesize
1KB

MD5
1095f9d8f5e3d98fe65f445015f49a30

SHA1
41c8a09dbf59bce3b0dca2a318949a6f5ad72cb5

SHA256
64268f96f5f2db8db51641bcdf366320c93e7564244b3615de6002affeeab64e

SHA512
9d47f2e7da65993ac51524ceb8823d392360d4a216f236c9db536226f5eaea35de312326927e782f884df648fa1b85a8a969f66dff49b3707b5f9b6bf9c9c7dc

Download Submit
C:\Users\Admin\AppData\Roaming\5F1F.3C5

Filesize
897B

MD5
fced31a949d3f29d8ae4c5fff86a2fc7

SHA1
15677a2050ba77275d3c0201095d7ad30dd11356

SHA256
9317e2d4b7218a5b2c98421db594720a9fab60edcdd9d1c7c343714aedbced98

SHA512
087dd09bca487e573d6ea1ed4f2002e8b15e3703d6a3c70806568f7b79fe5f00ec9975c4798da06fdcf7f5ba1e535f52d65f4f409bc5fb833661873fb8098d68

Download Submit
C:\Users\Admin\AppData\Roaming\5F1F.3C5

Filesize
1KB

MD5
4eb2bfe98f06154b1b7cc5f58f9c161b

SHA1
d5daa0fbaad8bbf06be4457c776e44d68c394a85

SHA256
b76dcf5d48755cf33bb3ff67eda8d0df6bd20a0b47c0163c97b8040f3d208f11

SHA512
429a5dc507303dc6e50c2cbe38394876e7c05dcca3656bac7ef2d94da68cb12ec9a78938bad9e8873feeb7dc3c55ed21c02591b49912606ccf689feb91196f08

Download Submit
memory/1320-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1320-91-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1320-189-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2416-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2416-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2836-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2836-90-0x0000000000335000-0x000000000034E000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads