04bc88ddbbf3d087002c780ed47cbcf5b3176c26d266e3a56870c3de47a6f08f

General

Target

3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe
Size

162KB
MD5

3ce34cd6be31ffd7f165700ebe220c07
SHA1

b5a9821960bc63957ce2855562d7a4524ef04371
SHA256

04bc88ddbbf3d087002c780ed47cbcf5b3176c26d266e3a56870c3de47a6f08f
SHA512

1ccaa2e25b664a3bc92ae6b3d6643c4fbb1ff1c3035e9208503bff9ef9a759a624e8a8611c0afc45daa9e0e6c7f58e2e28ffa1b225f91f2b38d73efd667856fd
SSDEEP

3072:AHOef1VXAuD1fY8Z6iLMDzK5YMwF9fCUFgvYrrsnTFADdWdvdpa80DSCegqTX:AHOesu1S+MqyMwFRCUFUYroeDdK+fpeV

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-1-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2764-4-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2764-6-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/3044-74-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2088-81-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/3044-83-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/3044-177-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/3044-182-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2764	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2764	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2764	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2764	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	30
PID 3044 wrote to memory of 2088	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2088	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2088	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2088	3044	3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3ce34cd6be31ffd7f165700ebe220c07_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CCE1.7A4

Filesize
300B

MD5
b106c9116bb72c6d57e518c9e726e37c

SHA1
10d6d654abbea52b802eea6d3b9d2ead74cf7814

SHA256
cc9dc880b21c9628c81ca60494f0df94d5871dd85d962912f8156ea9c9b33666

SHA512
8a1aa4f587ee55d45bb47610f5aa60ca11055f49c894479e31c60e7e7b6aec581a65f6a894df9ee5f7f3c1ead18e31bf652ef53a4764571bb0e5257989345322

Download Submit
C:\Users\Admin\AppData\Roaming\CCE1.7A4

Filesize
1KB

MD5
54df5933b513c3d54b2dc373bb833f58

SHA1
bdb0074821bbfe9e6fae0db6be209a4c31710abd

SHA256
3e7dbba19fc6143087469898b2bfa2f643afbcbfac6b0bca85042a546953fd88

SHA512
b4663b694be728baf8cc2a830f0cf194fd92b87ceed077422d8bfeb495e09d1bc85cd42b12b3e95f65f853b730847e976cad3ff4dc0b61c1850ab1f081068291

Download Submit
C:\Users\Admin\AppData\Roaming\CCE1.7A4

Filesize
600B

MD5
64146c0ac976c49d7d030d43d0204e19

SHA1
6d025d5f24d2778ccf1c6b17858b8d7075615203

SHA256
915d1bb41253819ceba72844608fa6a7178289ade980fed2f7cc49ef8f58f298

SHA512
581d084de637e258d49b030524f68981244cd4e0bb4e2c20046ad4b7fca2d1b59764f0bcb32e25564e7cd8389cd9417c44520a54471982a1c0ebe5dfb6e1d9ee

Download Submit
C:\Users\Admin\AppData\Roaming\CCE1.7A4

Filesize
996B

MD5
73d4f2fdee55ee40c99181585b9bd935

SHA1
8096392924d79bb8137486bb0de1f32f0b1cdc5b

SHA256
5d97781c2d176740af5fbc8c50fcd7182b98babe4fef07ceecfb28600a42d95f

SHA512
10f4cb9b089207c8341ff485c65b24425149fb23e963ef4fc863e1eb5012ce67d9c54a984fbb250e6888b0438a62fe98a9dbdf09bb3a09c208f9978af5da4dfa

Download Submit
memory/2088-82-0x0000000000917000-0x000000000092D000-memory.dmp

Filesize
88KB

Download
memory/2088-81-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2764-5-0x00000000002D7000-0x00000000002ED000-memory.dmp

Filesize
88KB

Download
memory/2764-4-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2764-6-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3044-74-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3044-83-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3044-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3044-177-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3044-182-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads