strela | ef5a4eb40733a378ba1dbfdeeecbcd0ba776d1fe7c293a703ee1431cc2a5f248

General

Target

3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
Size

5.4MB
MD5

3e1b475608a0f58b4f611025edbcb99b
SHA1

987e3e93bd65b4e17d341fe2c7986fa596249b33
SHA256

ef5a4eb40733a378ba1dbfdeeecbcd0ba776d1fe7c293a703ee1431cc2a5f248
SHA512

67acaf217150b3a073018c83614c61e8c9b2d58ce4ab849b3973d1eb024d9227aa8200caa9348b3313b3d43ea5c66bdd5e582d0b2e24fa64b672afe7361025c3
SSDEEP

49152:OQJ3vdwlU0AP5kdYTDuvFFrj1qWsWG9Adva5yheSWYJ0q:74U0AP5GYTMFFrc0va5yheSWYJ0q

Score

10^/10

Malware Config

Signatures

Detects Strela Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/4472-0-0x0000000000400000-0x0000000000993000-memory.dmp	family_strela
behavioral2/memory/4472-65-0x0000000000400000-0x0000000000993000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4472-0-0x0000000000400000-0x0000000000993000-memory.dmp	upx
behavioral2/files/0x000b000000023399-5.dat	upx
behavioral2/files/0x0001000000018996-12.dat	upx
behavioral2/memory/4472-65-0x0000000000400000-0x0000000000993000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\G:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\H:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\J:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\L:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\O:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\T:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\V:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\E:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\I:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\M:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\U:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\W:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\Z:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\K:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\N:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\P:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\Q:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\R:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\S:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened (read-only)	\??\Y:	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\program files\google\chrome\Application\123.0.6312.106\elevation_service.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\Uninstall.vir	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
File opened for modification	C:\Windows\3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.INI	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4472	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4472	3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\3e1b475608a0f58b4f611025edbcb99b_JaffaCakes118.INI

Filesize
1KB

MD5
cd13a6532dec6b9e7e4f14462e3e287c

SHA1
922f21847005e8937b65b3039445efd73403e183

SHA256
a5aca428d3ab62816dff3abc76533b15b81d0273ad828ca16a7690921dee6a4e

SHA512
498d0e8a4fcffd2dc7975668b4b9770cd16bcd99e571926432bd3c65c5a3451e94599b96bcd73525eef1924e96c8d85fc0cc60b411a164e29f411eada0b86d50

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
527KB

MD5
0e2becd8ca91e2d6d7b3a56b4fd5019f

SHA1
11cca25b66c5a5e04eaddef11ec7dbec9b591b5f

SHA256
6216203d38ae4f79a62e25a27f283ceebe8b9d7736faa66c1c90a1f3502a98f2

SHA512
e219f11a9e6723394d6a6135c84ba3a827a5c3e5a4f01b5ec5eab7e782077b14ba68fd734db5c6b261a6029f77d94a30ad9bf3bcd7b65b6b4031b6254b867f79

Download Submit
C:\Windows\SysWOW64\msiexec.vir

Filesize
162KB

MD5
8bb8b68808791dcf7c3d8652d5daafed

SHA1
a0d2c480c34ca96547f92814fdfd45f43f7fa37c

SHA256
3b3dda04142e299fb7de068d31c0fbeee3f96ac3904a85f756fd860e1db77b52

SHA512
6db68739e225b69f21eaede3c7a3a47bb4839af80c3dc214941ac7d7ee10ac975f16a637b46773b8c6aa58d84ef181d669cac579989313a7025443a33591ffc0

Download Submit
memory/4472-0-0x0000000000400000-0x0000000000993000-memory.dmp

Filesize
5.6MB

Download
memory/4472-65-0x0000000000400000-0x0000000000993000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing