3a496e21edbc2f26f141c796121250e8ea83ba38c2de9b2fdd1a9b3135b160ac

General

Target

4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
Size

108KB
MD5

4b47be1f9057a6bb502d373226569780
SHA1

1a86826e74e5a9e79dd97472d9b30223dd0e66ec
SHA256

3a496e21edbc2f26f141c796121250e8ea83ba38c2de9b2fdd1a9b3135b160ac
SHA512

d36019757dd8f3b107bfbaf5fe30cee954e07e90e1cf86e4c7e244be421adfcc4aa5222e28de2742745ed123c589136a5de1a16c0fd11d8a547e6bab8c467755
SSDEEP

3072:vJBU7f5Hyhj7k+zzjTJ7LqcdjDtR+W3axuygNyIt:vETwj7lzzjTp1xtUWCuyPIt

Score

10^/10

evasion spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	756136.exe

Executes dropped EXE 2 IoCs

pid	Process
2400	756136.exe
2248	756136.exe

Loads dropped DLL 2 IoCs

pid	Process
1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1064-0-0x0000000000400000-0x0000000000518000-memory.dmp	upx
behavioral1/files/0x0009000000016bf7-9.dat	upx
behavioral1/memory/1064-15-0x0000000002BE0000-0x0000000002CF8000-memory.dmp	upx
behavioral1/memory/2248-26-0x0000000000400000-0x0000000000518000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	756136.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index[1].php	756136.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system\756136.exe	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
File opened for modification	C:\Windows\system\756136.exe	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
File created	C:\Windows\web\result.dark	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
File created	C:\Windows\web\ddid	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
File created	C:\Windows\web\ddnm	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
File created	C:\Windows\web\ddsn	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	756136.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B5B5FEF-0A76-4277-BDF3-1FF13DBB5F18}\WpadDecisionTime = 10b685d3f5d6da01	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B5B5FEF-0A76-4277-BDF3-1FF13DBB5F18}\WpadDecision = "0"	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B5B5FEF-0A76-4277-BDF3-1FF13DBB5F18}\da-7e-48-cd-dd-56	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-7e-48-cd-dd-56\WpadDecisionReason = "1"	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	756136.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f01a2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	756136.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-7e-48-cd-dd-56\WpadDecisionTime = 10b685d3f5d6da01	756136.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	756136.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-7e-48-cd-dd-56\WpadDecision = "0"	756136.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\da-7e-48-cd-dd-56	756136.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B5B5FEF-0A76-4277-BDF3-1FF13DBB5F18}\WpadNetworkName = "Network 3"	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	756136.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B5B5FEF-0A76-4277-BDF3-1FF13DBB5F18}\WpadDecisionReason = "1"	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3B5B5FEF-0A76-4277-BDF3-1FF13DBB5F18}	756136.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	756136.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	756136.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	756136.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2400	1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe	30
PID 1064 wrote to memory of 2400	1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe	30
PID 1064 wrote to memory of 2400	1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe	30
PID 1064 wrote to memory of 2400	1064	4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b47be1f9057a6bb502d373226569780_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system\756136.exe
  "C:\Windows\system\756136.exe" /start
  2⤵
  - Executes dropped EXE
  PID:2400

C:\Windows\system\756136.exe
C:\Windows\system\756136.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\web\ddid

Filesize
6B

MD5
af6273cfd501714834eccc19c2c59df8

SHA1
11cb21deba2626ac1e020922d24b512f6b659844

SHA256
39627b5e4c0aaf8849dafc1fd7b585a94a349858096221885ebbb55bec381a09

SHA512
d41879b537f280a72bd61a8d74d50815767a7dfa083581f316044d7d77b49e0e3a9953acc62dbb311deb49301356da0676331cfb4318c4f53fb72e0ef6c63c25

Download Submit
C:\Windows\web\ddnm

Filesize
10B

MD5
1ddfcd411a4176f669034db88952ee45

SHA1
154c5b1a64b28db43b468bdb65f3870c267ac0c8

SHA256
d92ff27780e7969a72febf2b8a59212dd63af16b1b5c3daa06925b3537bb04aa

SHA512
a685456f7dcfc80117ea25a491b6c323bd5f8eb2fd649b95afea5c5f77764abfbb0cb1b2e42f403111befcb466b369862580d9f0e5ca09f53ece00c712531022

Download Submit
C:\Windows\web\ddsn

Filesize
5B

MD5
863a76ba2c63cb56d4e4c40508ac3de0

SHA1
30a6ebb597cedbe0e6176bdba7ca1e14d3353141

SHA256
b48f6ba463568ce38e5ed2860f95ef41481a73690210b0b6f1f35594888b4494

SHA512
c8a56d957459aa2089d120bfdbc1d8aab11a802c9cdad945ff51a1f1b93ccaea74a4415ec1064aec5b893be12211737e8ea765ed7ee8a41258abb6c10361281f

Download Submit
C:\Windows\web\result.dark

Filesize
32B

MD5
bb20a835bd1210468af8014aa6a022cd

SHA1
f3a93f807ff651d1b2ca1efb65a258de036a9fb4

SHA256
5f0f9de4feeb753b9c4bef8cb56070a3b681d8129f19e3874e39e99a105dd152

SHA512
1aa2e4b9185a68e3d1260c2189e49b9a16cf20fbc53260d974d2857728ff9b1d2a755a74df86d57e40850e157e6e13020898daa719c19b50e376fc5ec5cf7d98

Download Submit
\Windows\system\756136.exe

Filesize
108KB

MD5
4b47be1f9057a6bb502d373226569780

SHA1
1a86826e74e5a9e79dd97472d9b30223dd0e66ec

SHA256
3a496e21edbc2f26f141c796121250e8ea83ba38c2de9b2fdd1a9b3135b160ac

SHA512
d36019757dd8f3b107bfbaf5fe30cee954e07e90e1cf86e4c7e244be421adfcc4aa5222e28de2742745ed123c589136a5de1a16c0fd11d8a547e6bab8c467755

Download Submit
memory/1064-15-0x0000000002BE0000-0x0000000002CF8000-memory.dmp

Filesize
1.1MB

Download
memory/1064-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1064-3-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1064-1-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1064-19-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/1064-17-0x0000000002BE0000-0x0000000002CF8000-memory.dmp

Filesize
1.1MB

Download
memory/2248-26-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2248-27-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2248-30-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2400-24-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2400-29-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads