1d872e6bfe30f50be785cc6ef61bae06c74a6b9a0399d971eab90a261912eb0b

General

Target

274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe
Size

182KB
MD5

274442ff832fc49906cee21eaedd6e5a
SHA1

6eb2a4bc43b37474ec5cbd09d236e11234243374
SHA256

1d872e6bfe30f50be785cc6ef61bae06c74a6b9a0399d971eab90a261912eb0b
SHA512

45e48d49e02b01bbfee0ba83a6d781866b8f474d7549d03c75267c2ec4a8f50b1dfb0a4f038683bfdd0e81f8fc34048c5a5b9b1c175529fa7a6af411025fbdfc
SSDEEP

3072:il5exzEbLHIL84ImNmRP03sP5LMbe/pkHDCSsTy350KKPNX3k3uYD/UfmlRn:kW4Uel03O/KjfsTyu3q9h

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2292-1-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2484-11-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2484-10-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2484-8-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2852-88-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2852-89-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2292-87-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2292-203-0x0000000000400000-0x000000000044E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2484	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2484	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2484	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2484	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2852	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2852	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2852	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2852	2292	274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\274442ff832fc49906cee21eaedd6e5a_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\DF84.2AF

Filesize
1KB

MD5
72c2df8ba6130d612c9b7f792d5f5cf9

SHA1
d9bff6bf91b5d7a826133d778be417704878ee5d

SHA256
dd472ad4dc6b70a598e000f97282bbcbacc00828fd5b1c1cac829ebd15e68aec

SHA512
07ab10672f89ded291954785a8994c13028469d717e7514be72df5cd8258a6cf3d15a651a4642215034f147a011c6090069e54ef780287be854fba76030cdef7

Download Submit
C:\Users\Admin\AppData\Roaming\DF84.2AF

Filesize
600B

MD5
e180220159422a04f45470521d78ea48

SHA1
ca9cd596f08ea4dd6a41f785f0bf78e3b947d7b7

SHA256
3dcc7c693986fd21523aaa8325f3b5893df3197a9eab147e8c00109c15054c83

SHA512
46c4aa15c3be45e4b3932c6b98f1d6ec70f909b5f1c600a4dc8c32fbe8f23ebbf8a1596af042e823d2a1d5e4ba0a94f4af5465469dbd86d44ea6b430e1ea6b07

Download Submit
C:\Users\Admin\AppData\Roaming\DF84.2AF

Filesize
996B

MD5
d654ec1df908536c3774d68c6dcda9f1

SHA1
a8164d6b7f453eae81556cc84d8cdbb959849579

SHA256
3900ecb62b445cd3a8e46b502826bb264b0f82c27e2ab649ea1362fa1d0f9dd9

SHA512
a3ae229b3c3e511142f75db6643f9f6caa6481648658da72d57ff8abca5d05c5d7310cb2a56835f354dddce477da9f1af4ade71d697835a8cde2798abdfdc7c6

Download Submit
memory/2292-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2292-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2292-87-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2292-203-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2484-11-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2484-10-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2484-8-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2852-88-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2852-89-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing