17bcaa3a363e9f256881771f1ee97ade29dc760c6259e82df3ac056c73c4aa97

General

Target

5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe
Size

1.1MB
MD5

5a65825ba178c13015ed05666b247cdb
SHA1

f0c977e7d643537ff4f836700e75c01ea2ba205d
SHA256

17bcaa3a363e9f256881771f1ee97ade29dc760c6259e82df3ac056c73c4aa97
SHA512

1e63f64498d7fc40779698ab22d8fe04e105c84cb4a861a61dc198b4c8bb197762e274f8f0b67584a504c6dc4a34ab6c384622b642a783412c6a25633a603a57
SSDEEP

24576:pGZ8mmY5Ma+jq05cBgKxySbRSN5Y2CDLyvzv9XyNW/sh6GvBbJKZQ4cyiQ9obI:pG+mZMa+e0TcZdlDDWvzv9Cs0o2BbJKl

Score

9^/10

evasion persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/1212-32-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/1212-36-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/2308-45-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	47063.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2800	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
2992	37345.exe
2796	47063.exe
1212	dialup.exe
2308	passwordfox.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000016c03-31.dat	upx
behavioral1/memory/1212-32-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1212-36-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x0007000000016d53-41.dat	upx
behavioral1/memory/2308-43-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2308-45-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\47063.exe"	47063.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\47063.exe"	47063.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Firefox = "C:\\Users\\Admin\\AppData\\Local\\Temp\\47063.exe"	47063.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	whatismyip.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\47063.exe	47063.exe
File opened for modification	C:\Windows\system32\47063.exe	47063.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RPXOCQRF7-19-2024---4-06-35---AM.gif	47063.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe
2796	47063.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	47063.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	47063.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2992	37345.exe
2796	47063.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2992	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2992	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2992	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2992	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2796	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2796	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2796	2756	5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe	31
PID 2796 wrote to memory of 2800	2796	47063.exe	33
PID 2796 wrote to memory of 2800	2796	47063.exe	33
PID 2796 wrote to memory of 2800	2796	47063.exe	33
PID 2796 wrote to memory of 1212	2796	47063.exe	35
PID 2796 wrote to memory of 1212	2796	47063.exe	35
PID 2796 wrote to memory of 1212	2796	47063.exe	35
PID 2796 wrote to memory of 1212	2796	47063.exe	35
PID 2796 wrote to memory of 2308	2796	47063.exe	36
PID 2796 wrote to memory of 2308	2796	47063.exe	36
PID 2796 wrote to memory of 2308	2796	47063.exe	36
PID 2796 wrote to memory of 2308	2796	47063.exe	36

C:\Users\Admin\AppData\Local\Temp\5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5a65825ba178c13015ed05666b247cdb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\37345.exe
  "C:\Users\Admin\AppData\Local\Temp\37345.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\47063.exe
  "C:\Users\Admin\AppData\Local\Temp\47063.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\netsh.exe
    "netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\dialup.exe
    C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\du.txt
    3⤵
    - Executes dropped EXE
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
    C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
    3⤵
    - Executes dropped EXE
    PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\37345.exe

Filesize
512KB

MD5
bbd9d5bb5d7e429ac5b00e775bc9f00e

SHA1
7d447e4b6135c8065f9a611624b9f02207a40d41

SHA256
056702a14c5367f6dc50fd1e41515e0a756c999e206196d4e4014cfe41869c3d

SHA512
75a3f81f4e57f03ab4410810fb69306ce20d048da16418404bae32d08de5d788b633b69498244b75d452effb2ae528f610d984ace97765cc3c6ab7f1f7b1bdd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\47063.exe

Filesize
532KB

MD5
1690de336b22173f7ff4602618ee3fb7

SHA1
c2999b3f00becf1af55c70fdcb80c27d4638d9c5

SHA256
a294d76a8e2484fbbc43040d27fbe84caa71b172ad51f34ee34d14ed2d5e7bfc

SHA512
5aa412ebab56c0e2c25dbd14b58a8225d247398a7ec77c3f3f26292ff58dd9dc472eeb8ef944e292601b5512219eb3b6e4a74f07354ab933d6511c75e04fad84

Download Submit
C:\Users\Admin\AppData\Local\Temp\dialup.exe

Filesize
37KB

MD5
9c8872c879d0a9d82988920488370864

SHA1
87ff4231547462e6474c832e28831dd691d83fd4

SHA256
8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97

SHA512
3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\du.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

Filesize
37KB

MD5
a1d6a37917dcf4471486bc5a0e725cc6

SHA1
5b09f10dc215078ae44f535de12630c38f3b86e3

SHA256
8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17

SHA512
5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

Download Submit
memory/1212-32-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1212-36-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2308-43-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2308-45-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2756-22-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-3-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-0-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/2756-2-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-1-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-20-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-23-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-21-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-24-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads