4953ec2e9a15ad71bbf77758cf793f55a469f7e2abda785310f9345149230969

General

Target

632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe
Size

186KB
MD5

632fc4b7b8d2fde72c0e2286a90e9109
SHA1

6481b76e28aa98e4bfd22aecbd9f793b52a461cc
SHA256

4953ec2e9a15ad71bbf77758cf793f55a469f7e2abda785310f9345149230969
SHA512

79f250faf35bb51dca84b604e473c797794b0521d07025cd563809535c32dec3815eb81cbfa278448c806006240025acdfd96e69a4a2b28b74cb045f6bc87e44
SSDEEP

3072:gxPQ79wi1J0qv0Ws/JL8DtfaVM41qvoPDnDCmGfDrylkE2LqkGI5HxJvfvZ6JP8m:gbi1OqO8ZaVR1Z+DmAP5HIt8q

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2888-16-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2888-18-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1872-91-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2392-93-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2392-207-0x0000000000400000-0x000000000046C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2888	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2888	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2888	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2888	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	30
PID 2392 wrote to memory of 1872	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	32
PID 2392 wrote to memory of 1872	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	32
PID 2392 wrote to memory of 1872	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	32
PID 2392 wrote to memory of 1872	2392	632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\632fc4b7b8d2fde72c0e2286a90e9109_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BE85.0C0

Filesize
597B

MD5
1e8a25cccb35d9cace669e60d7b480bb

SHA1
9892635cf539b9948c7f9310d17ea808fa0d5be2

SHA256
bee5db65ba1af9e3357b698423f7212ddf1045e7c51603b20f09a2aebeb0cfd4

SHA512
63c29c02c7b1334cc3145c89d91397a6cf9b71c977d29466f0bb4e5a6157545335ac6ac700748e34d36a0ec9471716f02645f1cfc75ece95ed60ab9f9afa5f81

Download Submit
C:\Users\Admin\AppData\Roaming\BE85.0C0

Filesize
1KB

MD5
0b5fe085d4ae14bb0defd82a4c84abfb

SHA1
5f8b028bf7fbfbee3aaf36967719fdc843eae673

SHA256
bb95831fc445d88757e88317bfd254d96b6845b30d7d1b71713c1e76ebf5343b

SHA512
fb4531e1ce98f8d31370cc3170af54d62a69e27a8123040473cfbc0ec251c82ec75b64892be64b8dc43f88668ee95d868eb4615891bff0325ed1c70fd7910853

Download Submit
C:\Users\Admin\AppData\Roaming\BE85.0C0

Filesize
897B

MD5
55c32c488ad97dc7adeaf6cc1b3130ee

SHA1
763082a69bda934e8e3256b82933207b55038f2d

SHA256
7adae7f69c51e0a5af7ba532b58a1cda918291c2ffe9ff57d8347166d6a7437f

SHA512
b33eda78f1192b1920533ce39727307e2654abe94936693e0497180bbaa8060e16fc9bf6783a08e611f9977e632d07636a78cf6e2b929ec43de131a3da9b2004

Download Submit
C:\Users\Admin\AppData\Roaming\BE85.0C0

Filesize
1KB

MD5
2938bf6976f760247322098abac3efbf

SHA1
6c0145ae048d9627181d6a6273e058591f80ac54

SHA256
33f6c4a1ff9bc1ae534e0830fcec9cd5d8f91e47e8d903b85971d6502126871f

SHA512
6fdd2cd856854be067647600c793d7498c82539ce21ac704427d03cd934e225bc5f2de9a3da15ee3b2993c87396b0852438dad968bf876103dc63e75757b98b7

Download Submit
memory/1872-91-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1872-92-0x00000000005B9000-0x00000000005D4000-memory.dmp

Filesize
108KB

Download
memory/2392-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2392-93-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2392-207-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2888-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2888-18-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads