d58e45b6dba849b407bd1b0bf9924e93a1e402e2bc6e7f6444afe34a2f76d885

General

Target

8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe
Size

176KB
MD5

8290670d207dfbc07c5b0c8bcb0ead2f
SHA1

6e850a739f941c3f593ed0af72d2237104485796
SHA256

d58e45b6dba849b407bd1b0bf9924e93a1e402e2bc6e7f6444afe34a2f76d885
SHA512

da75563f12576fe310e60fca85c8310aeff3a8e6d4fe77f21eb2de063d9b2cb3869143d8a5651f11a7214933fdbcbe8004c2121d1a3729db8175c2fd2f3c1071
SSDEEP

3072:uvBWrsRoJEmLLDesgo/WW4XoIQzFEtLOK1+bAW3t3wJHZ4R5bJ:upWAYNDf/p4XopEhL+bTCJHQ

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/780-2-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/780-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/576-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/576-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/576-16-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/780-17-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1028-131-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/1028-132-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/780-234-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/780-305-0x0000000000400000-0x0000000000455000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 576	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	31
PID 780 wrote to memory of 576	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	31
PID 780 wrote to memory of 576	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	31
PID 780 wrote to memory of 576	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	31
PID 780 wrote to memory of 1028	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	33
PID 780 wrote to memory of 1028	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	33
PID 780 wrote to memory of 1028	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	33
PID 780 wrote to memory of 1028	780	8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe startC:\Program Files (x86)\LP\4FFB\97E.exe%C:\Program Files (x86)\LP\4FFB
  2⤵
  PID:576
- C:\Users\Admin\AppData\Local\Temp\8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\8290670d207dfbc07c5b0c8bcb0ead2f_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\B5196\11E4F.exe%C:\Users\Admin\AppData\Roaming\B5196
  2⤵
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B5196\64CE.519

Filesize
996B

MD5
64c323d26c3adf9c02538f4215185dba

SHA1
16835dc60d28f76cb94ad5c0507a39c47231efdc

SHA256
78da41258fdcc3ed6550ef59523012c23165dabce62b44935825ace729e70027

SHA512
02813a69400155505c73cea138ec43cadf1fd021e63b7d973221f45624b5230342f361d88f93c2c2de6c09a24398d744cdaf2901a05672f3532dead371091a4b

Download Submit
C:\Users\Admin\AppData\Roaming\B5196\64CE.519

Filesize
600B

MD5
efd66105aebba98981dc228f778e4d29

SHA1
aa8e3eade8396979d6b1e78bae66ef029052af56

SHA256
d34dea756c591e517ab40acc679f4883117d724f879d90cfddadf05c6599778b

SHA512
8af482d2a384a7d8f63049294a8e11f95cf6c28f56cc14679ee387e51d985707fa0cdd099e0a08330097440f4b8823d461d6db5f4afcbfde15fdc8b308f8bce4

Download Submit
C:\Users\Admin\AppData\Roaming\B5196\64CE.519

Filesize
1KB

MD5
9dcb18fa57d00301e783f35d164442af

SHA1
60a82c4cdcdeb688feef3c2cc029b9d088042236

SHA256
24ae287aceb562a424b21521aae21beefe805ed943a08ca2eeaebce189059b80

SHA512
7ae820672d3966ed0c92c5b8e0772abbb0bceb7d85d021e04649f9817f2014a7fe8f486f4be7e5284c07bbcd1d806ca2a238306aea6e44299a4d3f7c4c39f430

Download Submit
memory/576-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/576-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/576-16-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/780-17-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/780-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/780-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/780-234-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/780-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/780-305-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1028-131-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1028-133-0x00000000005D5000-0x00000000005E1000-memory.dmp

Filesize
48KB

Download
memory/1028-132-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing