f2fbf9032bc1d81d5d0fb53d6a164e3f0b458337f0c11dc00c89fafd782b6a9d

General

Target

83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe
Size

171KB
MD5

83ab74819ce56d0fea294746e8413f0c
SHA1

7fa60e88ed471d822721e5c0eacbce9d15918ad4
SHA256

f2fbf9032bc1d81d5d0fb53d6a164e3f0b458337f0c11dc00c89fafd782b6a9d
SHA512

3316de5a829a78786a25306c6eeae0a3efcee0f4dea74f62be7dda76f01d09045bf7e6ef881820e87c3d77c573da0721b64b012c7df3665c9b99ea00885f0468
SSDEEP

3072:VbxAVitmm/aGvGx6x1hXckFHuwFFW2lEUWXQASMOoLtLLDGYOViasyozC83uta7:V9sicmyGlxdpuwFDj4b5/LpD/kUCja

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2780-1-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2780-2-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2404-5-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2140-78-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2780-79-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2780-170-0x0000000000400000-0x0000000000462000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2404	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	30
PID 2780 wrote to memory of 2404	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	30
PID 2780 wrote to memory of 2404	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	30
PID 2780 wrote to memory of 2404	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	30
PID 2780 wrote to memory of 2140	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	32
PID 2780 wrote to memory of 2140	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	32
PID 2780 wrote to memory of 2140	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	32
PID 2780 wrote to memory of 2140	2780	83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Users\Admin\AppData\Local\Temp\83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\83ab74819ce56d0fea294746e8413f0c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\12B9.63F

Filesize
600B

MD5
fd2346b2fc6e240a603388c5e15275c2

SHA1
4e336f5d9ad4411024e01cbd17601e860c7fc95f

SHA256
cd2681176d67399078215b03d25df3ffd5b0781984fc73f09c7819db261a9017

SHA512
88aacf97597cb2f97163e1c302adb3d50e36bff71f7d7a8ed1a8cbed3b62d90f2c63a9970735f02f0f4a1f1460e4ded75b5be7412775241f53f5187ecc44d6e6

Download Submit
C:\Users\Admin\AppData\Roaming\12B9.63F

Filesize
1KB

MD5
60258d2be10806dc40c6a09507da2671

SHA1
151b237d17633c296cdfbb15c00101809ebdfde4

SHA256
4a206f30c445de6a8f1bd34a6a60326d6b39d77195ad0148b7edd12fb836e59e

SHA512
1526c3294e6eea4643664fae5a9b14c69a1f32bb5ac4c92108fffc12269e00c4471d242e25315335d1c5685e118462f097ef682e5db14105de445a4ea4959615

Download Submit
C:\Users\Admin\AppData\Roaming\12B9.63F

Filesize
996B

MD5
446a8ce8d7c538096c8373d08e3ce81d

SHA1
8b38a5e2f503a1f4a3e268cebca419917d6551ce

SHA256
f73471ba9202e92ee6123c678cd20b3a447de3fac523009f49e74941ee2e3561

SHA512
4edf487d6c13a49f8290ef182256f04f37dde89f289641891c9f12f0bc4ce96d8e01224464dcfe25545e0f206fb65444cb77ecedea424dd15c447ef04d68953f

Download Submit
memory/2140-78-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2140-80-0x0000000000684000-0x00000000006A9000-memory.dmp

Filesize
148KB

Download
memory/2404-5-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2404-6-0x0000000000674000-0x0000000000699000-memory.dmp

Filesize
148KB

Download
memory/2780-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2780-2-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2780-79-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2780-170-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing