583e0718cb33f423ecc9a45bc1a57ddb7f7cb7969d22023369a38d98f8ea337d

General

Target

647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe
Size

189KB
MD5

647e4617b7d6402aca842ba0dd7f4072
SHA1

1fd218bc6c1137f5f39bc136a1eecd3395533574
SHA256

583e0718cb33f423ecc9a45bc1a57ddb7f7cb7969d22023369a38d98f8ea337d
SHA512

e0d105f1449bcd59437db6bf2f5d30438db6732e1e2ca9ec2145107354f93089168cf50ed38077ba8d7bad33745c56c572ec10428c7287e19d396df05598d344
SSDEEP

3072:+dRDvMQXf62Rc7QWG0IRp3v3ucGAhlBr23eJdDuZF2JVFlOpaju2c2NLGDZ8dVua:oLMQnG7v3Iz3GcGsDOebyZQapAzcZ8d0

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-1-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2680-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/1808-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2680-13-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2216-72-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2216-74-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2680-162-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2680-199-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1808	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	30
PID 2680 wrote to memory of 1808	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	30
PID 2680 wrote to memory of 1808	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	30
PID 2680 wrote to memory of 1808	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	30
PID 2680 wrote to memory of 2216	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2216	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2216	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2216	2680	647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\647e4617b7d6402aca842ba0dd7f4072_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A435.957

Filesize
1KB

MD5
d36582525b45ed99fba650c9c322d5b4

SHA1
45d98feca76c5e3e50c2db280d03ab9b6c8b18e4

SHA256
eae4f493af6c49da330ce5add153e08013998fb0faa8de207b14aa4c388ccdba

SHA512
f8f3b39028e6548012bf6f59f55c2ef992e4aeb46516b341f1d099ec0d06de5ff3fbb8d461ce490d7dfa0a958cf353336c9cd117a5f2e7e72c38eef70a604f0c

Download Submit
C:\Users\Admin\AppData\Roaming\A435.957

Filesize
600B

MD5
5ac59b4a0592de0a5d44e63050273d65

SHA1
bc521b42a7558b1736b3ad5ff17ffeeedceffc86

SHA256
7a68ffd179ac43bb219fe0216281ac067014f4953d33d81bf2d2f952693178ed

SHA512
e7fe40c2f6c238deb44ed5dc9009ea82457298266a7f9d4a124acc0ee0b50f4260bcc56e17f786cd92f9934dee9d14937fc49dc4595a8d9659f9e951978ff444

Download Submit
C:\Users\Admin\AppData\Roaming\A435.957

Filesize
996B

MD5
ed77d6f908d096835c240c4bcd44b608

SHA1
6fcc53b2ec2e7fb377db87e4c5157f296bc666a9

SHA256
cb4d995d99f8fc68c4f790e937a09482e3297b85ec9d90aa51294d88e128ea5e

SHA512
a477be4d30b059c4dece7d78507f4241d05d30beafc107d9ea57200ab61dbb6aeb455266cbe07b09f3fc8761690357f3f2c3f2155f6eaa4c73870193cc4fa32d

Download Submit
memory/1808-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1808-6-0x00000000002D5000-0x00000000002FF000-memory.dmp

Filesize
168KB

Download
memory/2216-72-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2216-74-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2680-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2680-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2680-13-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2680-162-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2680-199-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing