6467321e31fba9777045a02a84ea65fb9245587d3762c49c4d9dac12bda32537

General

Target
72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe
Size 41KB
Sample240726-f2vm7asakd
SHA256 6467321e31fba9777045a02a84ea65fb9245587d3762c49c4d9dac12bda32537
MD5 72bc90ce5c941c0cb083619b3b39e5d3
SHA1 4c34a22c9b052bf77a1f1d5a5e653c37ce302b9b
SHA512 7195bdb9bd6b691d3e0b0d3b1ebb4bd57ccfaa2fcc8cc6299f4e6a672500f5f4dffad525db33abc7d4d884ba003d65717253e779d620e844e580ceafd0f5647e
SSDEEP 768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+IsLYq6K50O:s9Z3KcR4mjD9r8226+zYqj5T
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4920	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3564-0-0x0000000000240000-0x0000000000257000-memory.dmp	upx
behavioral2/files/0x00080000000234eb-6.dat	upx
behavioral2/memory/3564-9-0x0000000000240000-0x0000000000257000-memory.dmp	upx
behavioral2/memory/4920-10-0x0000000000780000-0x0000000000797000-memory.dmp	upx
behavioral2/files/0x0007000000023396-13.dat	upx
behavioral2/files/0x00080000000234e8-30.dat	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe
Token: SeDebugPrivilege	4920	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4920	3564	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe	84
PID 3564 wrote to memory of 4920	3564	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe	84
PID 3564 wrote to memory of 4920	3564	72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72bc90ce5c941c0cb083619b3b39e5d3_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 359KB
SHA256 151b1c2dc93001cc17fff355e951b3ca809fdc3a5a868f3ad54b628df01bb121
MD5 ad3fe360e4a7d066058ec8af2d7476b0
SHA1 21b81ecd7451966be7beff7903b9af6c34298c78
SHA512 e2a1c63ad47246003dad0602617dc9fd566693ab3c8299ce788437d4880eefa516419199baf38dec09439eea9ae30b5e53a355ab5d2ca6c8a4d387af390a4e12
SSDEEP 6144:/L8KjgJyIGq+ojRKgzEFP0wI8SEMad2SA2krL1N/epApGYMIYJXVOoej:/L82gkSRjRxe0wI8WadBCrL1NWnISOoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NTdptI515mq04vz.exe

Path C:\Users\Admin\AppData\Local\Temp\NTdptI515mq04vz.exe
Size 41KB
SHA256 ae635ea83502cda62dfaf091d13f04479deb5d8edf3578ad65ca8f1743838c73
MD5 eb74519a38c65cddfae45ba4d86afed5
SHA1 fb7524fce74b3a7b0830ad39fc38aaec9c916335
SHA512 bbd740ae353bfb024d120d5bc365c473a6a0449036a1eae6462518cbbe7bf1975b78af360249547e77e8ee2d4b46343c154ca98eb122f323004136bf4537bbf8
SSDEEP 768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+IzJsfH0Bo6iv0:s9Z3KcR4mjD9r8226+MLotv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 36KB
SHA256 b34e329ccf6505654d091c3d1448da9165a4fa2e852cbf6850e2b0dcde3f73f1
MD5 a9f2bba1cec4713c7960ac9d4e98b239
SHA1 175f61181d51ec40ba5a4da38016f2456c991ffc
SHA512 7322a59b67a65cc984ad4506955b7139a42e2959ade335b2a20f229253056a41238d894d7b470ce5a956737c3380d2e03781d60befa2b53b5696802fe8b9c428
SSDEEP 768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+I:s9Z3KcR4mjD9r8226+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3564-0-0x0000000000240000-0x0000000000257000-memory.dmp

Download

memory/3564-9-0x0000000000240000-0x0000000000257000-memory.dmp

Download

memory/4920-10-0x0000000000780000-0x0000000000797000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads