622ec38350ef232c097f4759f3e978d892f18ffca77febd053017a602025c92c

General

Target

5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe
Size

183KB
MD5

5b8a576e4b247184a53f0688601fa265
SHA1

8677e593d9794a7597f5ede650cc79f8c5d92c0f
SHA256

622ec38350ef232c097f4759f3e978d892f18ffca77febd053017a602025c92c
SHA512

56a489e555bf7257157544654501240213203410c6fdefe93d47d94de67d5b0032c01fd2b60f36eba26e478307d25a3f0aad0013073676b05e76acaa9c96fa55
SSDEEP

3072:0GScvnAigS+b3LNKQenbAr5tzq49hSbCHp7/afzceOAB/s7TjiWLNIVatWtDw6uO:5RvAM+b3CbEtzq4CWBafzZOGeiWatEhw

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-2-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1248-12-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1668-14-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1120-88-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1120-89-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1120-90-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1668-91-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1668-191-0x0000000000400000-0x0000000000490000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1248	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1248	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1248	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1248	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	30
PID 1668 wrote to memory of 1120	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	32
PID 1668 wrote to memory of 1120	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	32
PID 1668 wrote to memory of 1120	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	32
PID 1668 wrote to memory of 1120	1668	5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5b8a576e4b247184a53f0688601fa265_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C9EC.BDA

Filesize
996B

MD5
6fafb81f70b86acc2584219b250f7289

SHA1
3e90100db31169d830b0133cbbe95d4c904d1ce5

SHA256
00d6f84f502372437c4ab610066e4693ccfacc794b33775402912f2667217cbb

SHA512
35ea7448768e77d1bee16f0753a707647e4600df880ed7a1848927c2e0e725a49e79f960ce1f9da595de40cde50b9588dbb25a46c454f3102665edd49749adb7

Download Submit
C:\Users\Admin\AppData\Roaming\C9EC.BDA

Filesize
600B

MD5
2c10e657447efdbd25ceac1e48ccbab3

SHA1
921400dcd129a49d36272e488bc5f38dec76d664

SHA256
4e2e966be10cf7816e7623d2b3e00f20bef4f6498b287526720385277ec7536d

SHA512
41117ee19dc3554d6d135a8a23b094894e4b04380b1573c929acc34c43fd85ca94407c1f5d8f7bafc5898237a810e713e1236eed3958558807f60d9f52d42aa8

Download Submit
memory/1120-88-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1120-89-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1120-90-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1248-12-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1668-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1668-2-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1668-14-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1668-91-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1668-191-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads