9837c79c752713d7405b294e051816c59fcb6e98d1045c25d21414379827b72e

General

Target

482352584645a5624483d8b5335abf97_JaffaCakes118.exe
Size

168KB
MD5

482352584645a5624483d8b5335abf97
SHA1

c07bd38c1db36d413173af12755a0d512ac71ec8
SHA256

9837c79c752713d7405b294e051816c59fcb6e98d1045c25d21414379827b72e
SHA512

010857da0a99e97d534d3fde7e510263a741ec17121bee35790f6185d33dcd3b799fd5c97aaf83e4ad3735d4395f1d3af12608689a1fa9661e0d0a8bb661ea6d
SSDEEP

3072:UtD0uBhYKeZH2Fi1ZcmpWpFg91IxW9KmyFn8eTs8:UxNBhYFZaiFpWDgrIxoKmyxjs

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2756-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2972-13-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2972-12-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2972-14-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/3028-80-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/3028-81-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/3028-79-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2756-78-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2756-186-0x0000000000400000-0x0000000000444000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	482352584645a5624483d8b5335abf97_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2972	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2972	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2972	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2972	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	30
PID 2756 wrote to memory of 3028	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	32
PID 2756 wrote to memory of 3028	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	32
PID 2756 wrote to memory of 3028	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	32
PID 2756 wrote to memory of 3028	2756	482352584645a5624483d8b5335abf97_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\482352584645a5624483d8b5335abf97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\482352584645a5624483d8b5335abf97_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\482352584645a5624483d8b5335abf97_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\482352584645a5624483d8b5335abf97_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2972
- C:\Users\Admin\AppData\Local\Temp\482352584645a5624483d8b5335abf97_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\482352584645a5624483d8b5335abf97_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44F5.ECD

Filesize
1KB

MD5
65e3b01c3cd8c822ba03bce634daed68

SHA1
5f0518d60b84ba282f7c1f25ec9fd4d4997f40fc

SHA256
51df1da4bd8f8b9b6b4385c508607a2b356af93b6e6b88929b319388cf3a310e

SHA512
76435921f35362cbf505bb4312787f3ec7e541c2fdb8c72a82341f83d968033ff18e46bd13ebdcd142d0a56ef322b954bd123918982fd66bd3aa819db4df35a2

Download Submit
C:\Users\Admin\AppData\Roaming\44F5.ECD

Filesize
600B

MD5
d2952c786266945a256609d53b4bcdf2

SHA1
c5ae91ea35a941045865042db93d54d529127e39

SHA256
70b06835263650a6e95403e36fcec1e580ae14e2b4e8899301ac52e4e94e0c56

SHA512
4489f722041b6e07021b51906b0116065809a0814a3c11f8cf3d2738d7027d2a46e49ad82b71beab2728c961d10b17622f5556e61a2254fb98d333ac910c60f4

Download Submit
C:\Users\Admin\AppData\Roaming\44F5.ECD

Filesize
996B

MD5
5e89477a0ee143a8e8723fb32f96e12a

SHA1
065e08a87a9d5de8bf87d8c5cfb65be5508ea347

SHA256
d74930e7d8e969fc4d33849dd3e37e765f23292fcaab25586b8c636428684133

SHA512
9e12dafe0cb833cd0e8764f72c6a7ff5de6993f38a9db52f8bbae08956904bbbc3f02150627b84ca06060a9f90f66af3bb05f23bf430f89f1d243fda03309d9c

Download Submit
memory/2756-78-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2756-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2756-186-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2756-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2972-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2972-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2972-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3028-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3028-81-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3028-80-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads