827030e8453d8f5a75e13d8f304d1d5b540cc3cba45bc430cd5c0b1e00b2ea91

General

Target

74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe
Size

50KB
MD5

74d5e36f7e616f2a8e892676aae20cbb
SHA1

93c22036740a6ab7fc5ee4e68cd8f9751882be3f
SHA256

827030e8453d8f5a75e13d8f304d1d5b540cc3cba45bc430cd5c0b1e00b2ea91
SHA512

c2e4d0d7e5cb15b224557766818e2588d885b63f7db88244c91f18bd31bb01fb6ccd50c73c30b69d447bb33d95b2d71566d80bfba85623aa839f6ce6a41f3724
SSDEEP

1536:kgt/Mu4CGEQst45wgtgP5fJHm3OB/vwwryQ:kgx4HEQstgV+Prr5VyQ

Score

10^/10

discovery evasion spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe:*:Enabled:ldrsoft"	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4756-0-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-1-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-2-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral2/memory/4756-3-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-5-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-7-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral2/memory/4756-8-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-10-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-12-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-14-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-16-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-18-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-21-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4756-22-0x0000000000400000-0x0000000000492000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3608	4756	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe	110
PID 4756 wrote to memory of 3608	4756	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe	110
PID 4756 wrote to memory of 3608	4756	74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe	110

C:\Users\Admin\AppData\Local\Temp\74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\74d5e36f7e616f2a8e892676aae20cbb_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\74D5E3~1.EXE00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\74D5E3~1.EXE00.bat

Filesize
192B

MD5
a58bca04c464541d95863f995b6edc77

SHA1
5ecacc9359fe2f4434acc567c394079af11c9318

SHA256
3090a8f5e12958fe8d2440d1965c9e0f0086bc0459c769cfa83a0c432cddfd72

SHA512
8e4d014f6a32484e170ec4561e5ae3d180a6a9b663dee213a99d6974f486e2c57b91775675132f5afdb6fe8b13db5a976a23d046d625285abb996d0651d0bc62

Download Submit
memory/4756-8-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-12-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-3-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-5-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-7-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4756-0-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-10-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-2-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4756-14-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-16-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-18-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-21-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4756-22-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4756-1-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads