4b77f380fe943187e479d7b2893b18521da0f2f0ccb9067b81f38e352102bf8f

General

Target

5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe
Size

49KB
MD5

5dff76b603bb44462f446625d2a39ee7
SHA1

43521db8576a9edfe56169def9199b8aecccddef
SHA256

4b77f380fe943187e479d7b2893b18521da0f2f0ccb9067b81f38e352102bf8f
SHA512

426661837e7541576fc81fd444eb25987117db964db2d14eee5c2f8e2e3a8474a27f46ea0c9984dce6d9809f4796b3399f442abc6f383b212ce662beef7734d8
SSDEEP

768:Aa7JujtAKW618WFDS4STyAZ44G0GJKeq7uEET9r+v4cxfjJNut:BMe8GLTovJk7urebNu

Score

10^/10

evasion spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe:*:Enabled:ldrsoft"	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3620-0-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-1-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-2-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3620-4-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-5-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-7-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3620-8-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-11-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-13-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-15-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-17-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/3620-22-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3620-21-0x0000000000400000-0x000000000145B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1704	3620	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe	107
PID 3620 wrote to memory of 1704	3620	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe	107
PID 3620 wrote to memory of 1704	3620	5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe	107

C:\Users\Admin\AppData\Local\Temp\5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5dff76b603bb44462f446625d2a39ee7_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5DFF76~1.EXE00.bat
  2⤵
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5DFF76~1.EXE00.bat

Filesize
192B

MD5
a53c7dec6e5775eba20c7abf063e5ba7

SHA1
0a16c64b96fc68e3ff5711f4c2ec8af74610d5a5

SHA256
6336dab53d304b1a09c009359bef1cd120b36bddcece70077bfc473b8a65aea0

SHA512
5f708c9abaf930b0b2853e2e8aa248c2454f605cee71ced17bd415e19ac481e2a4ef9dc83fb3d5d45f435766016f2b969eb6541c2c9127bcf46c544661d9aba8

Download Submit
memory/3620-8-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3620-4-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-5-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3620-0-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-11-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-13-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-15-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-17-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-22-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3620-21-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download
memory/3620-1-0x0000000000400000-0x000000000145B000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads