1aabe4b0564aee2a7217827d856ed33891ba2e959a9241511b00786722dad294

General

Target

2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe
Size

177KB
MD5

2f3a6056c48203a1750d8b34c55f0055
SHA1

c0da2e19b6cb5904d81a94babfbbe85687e09d81
SHA256

1aabe4b0564aee2a7217827d856ed33891ba2e959a9241511b00786722dad294
SHA512

34b492b974ffe03ed2d0caa41051858ebe0a74e567be55e36cdc8dc80ca972e5df87ce3a4d4891b3e8f38e07937191ad4c70ba553e46e3eec5706056ce380644
SSDEEP

3072:Mch+Brm2fU37jwKnkSM63PYwjI9gVgfYr5ApBQoh7v635OsVQD6TgGKTeO:1h+dmKU3XnkSM63ECJrTJJOvD6MPTeO

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2576-1-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2108-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2108-7-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1760-84-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-86-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-193-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2576-198-0x0000000000400000-0x000000000046A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2108	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	30
PID 2576 wrote to memory of 2108	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	30
PID 2576 wrote to memory of 2108	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	30
PID 2576 wrote to memory of 2108	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	30
PID 2576 wrote to memory of 1760	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	33
PID 2576 wrote to memory of 1760	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	33
PID 2576 wrote to memory of 1760	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	33
PID 2576 wrote to memory of 1760	2576	2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2108
- C:\Users\Admin\AppData\Local\Temp\2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2f3a6056c48203a1750d8b34c55f0055_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\70AF.50A

Filesize
600B

MD5
6e3570e03321feabf1430ad330dfea52

SHA1
dfb1d6035359337ce59afdf5648d4110516a58fc

SHA256
031344099732993fa957d5f0fc22cd52a1b562f9cb85b7b8ba73b9a6987b5007

SHA512
f0dc645357dc40abc9de315f8230972a253962f934b0714c6c98d01b46760c9c6518dea63c13a8d3bda6baaad1950689157a0a0fe55667ea301815d47cb6ead6

Download Submit
C:\Users\Admin\AppData\Roaming\70AF.50A

Filesize
1KB

MD5
656b570c215628a553687e92ed101fb5

SHA1
cd79c2d967f4cf63dbd940bb9aa450370c25a6c4

SHA256
8bbb54d094b2c2e7a0bb141a0f6c43fa7401c471c9204fb1679eb7cd2d69f181

SHA512
819062d098f00f56d94d09a75281ed94bb2c58a15fd98abc191dc816a94e16ae8ce6230c3c7b54523f7410557b6edfd6760eea01c90babca09c7de2c1f3fd287

Download Submit
C:\Users\Admin\AppData\Roaming\70AF.50A

Filesize
996B

MD5
1bfb9823728b22145dcb1c2f7a8b25d2

SHA1
efa8c4b97ed42906081946b3851d9fd43133e556

SHA256
dc06ac6f031cee461b7056a3f9d5a3f3f0a3ad7c2f11cc49a50269e90caf39d1

SHA512
86caf170dda717e7697df0614afab1877b763a492298c8b6c451d94f2b8bafd99f995f4620a52abc27471f5bda34b2d1c116979648e37f1c74fedebd2c4a37b0

Download Submit
memory/1760-85-0x0000000000275000-0x0000000000291000-memory.dmp

Filesize
112KB

Download
memory/1760-84-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2108-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2108-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-86-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-193-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2576-198-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads