602ef0312630f1d30fd84919ce1a7fc6f5f7f6ba0bddc6f1439da8a85486c565

General

Target

6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe
Size

167KB
MD5

6aacff039ecc14f67b014ce8e0f77a57
SHA1

b694ad72ede843f580ada331f88ff7c8d29ddf0e
SHA256

602ef0312630f1d30fd84919ce1a7fc6f5f7f6ba0bddc6f1439da8a85486c565
SHA512

0800430ac64cab8f55a17e0e7a65a7126f06d2ddcea43f73d646a49cd374eedf49c4de15e4c43e7fb6c78503237722f373e5902b92bfc4fab15e3bcc09c8ff51
SSDEEP

3072:XRMg1yWX9NfO/qatRGwHKmDG7b4RdLASnGX4fEsF7vecbpBo4j9S6Ypr:XR51FOywRGQhnQ4f/Fzjz9S6+r

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2228-2-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2764-5-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2764-4-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2764-7-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2228-14-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2856-73-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2228-74-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2228-165-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2764	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2764	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2764	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2764	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2856	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	32
PID 2228 wrote to memory of 2856	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	32
PID 2228 wrote to memory of 2856	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	32
PID 2228 wrote to memory of 2856	2228	6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\6aacff039ecc14f67b014ce8e0f77a57_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\9464.496

Filesize
1KB

MD5
930161500572fd4bec28d4b502f0c682

SHA1
d17f8550e54b12826d5c8667f45e3b6e5235eb27

SHA256
670faa4cfb025550e5ced7c59db2ae0507c2758944ca0259d482285f5b9c42b4

SHA512
c0a872d0fc3f390ce7736d9a5ac0f420ad9238674215aaeca6899b4628f024b690a8cbb9e8f5bab55c457469b9e6e738aa8b28946fa064032ec1a610e06786f6

Download Submit
C:\Users\Admin\AppData\Roaming\9464.496

Filesize
600B

MD5
ea1bf97b98962c73f7ca2a234fa2c981

SHA1
794ee110e0c7bae9b784f6a9541ac70ff747e161

SHA256
f8b0f58e47893f859f2ceb8cb7861fdf7ab75853000e094993b7e7df3f41e044

SHA512
db3a5f0aa5efdba4f0c410173f68ce716979e510c426ea41634ca2d207446e566f1b9aa828f2079c762fc8235342db540c57547778f3be00a130d450be8968c7

Download Submit
C:\Users\Admin\AppData\Roaming\9464.496

Filesize
996B

MD5
d57e55a1a69ede52bbb064b5212ceede

SHA1
611150ad21efb1fd974f3dc8c6bf286b1bc0f20c

SHA256
2767b09f72d6d091dce87cde6e80a1e5a44795a52ca4dd688d8ec52afa1416c7

SHA512
09abead6c33c149ae16ee6f548e9b772df27c099a06f769a7534b86e526edbd704b38cb534b3b34ec55c3d737036c07231db773a23fd698a2861858e4a1ef0f8

Download Submit
memory/2228-2-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2228-14-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2228-74-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2228-165-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-5-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-4-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2856-73-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads