ac3e23a76008c478032ab75f4692abef518abc0e0248739683c4d4043de9f269

General

Target

a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Size

356KB
MD5

a7f612c73daf4620e95744c67df4ab84
SHA1

9057646a1d9057879cd40dfeb092108686d063fc
SHA256

ac3e23a76008c478032ab75f4692abef518abc0e0248739683c4d4043de9f269
SHA512

19c52e1df2d2fed53459067fd2051f288720bd417e5a2027b8d740b743ef69cf3a51e328d10cecc33e012634546b868b43e25b6de0a763a816d5eacfa76ebb25
SSDEEP

6144:63SFonFamhK6X3NyXjpm+dxKgpblW/cK:gzLL9gmau

Score

8^/10

discovery evasion spyware stealer

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\2e81c0b3	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\runas\command\IsolatedCommand = "\"%1\" %*"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\start\command\ = "\"%1\" %*"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\start\command\IsolatedCommand = "\"%1\" %*"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\ = "Application"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\DefaultIcon	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\DefaultIcon\ = "%1"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ico.exe\" -a \"%1\" %*"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\runas\command\ = "\"%1\" %*"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\runas	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\start	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\Content Type = "application/x-msdownload"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\open\command	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\open\command\IsolatedCommand = "\"%1\" %*"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\runas\command	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\ = "tqs"	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\start\command	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\tqs\shell\open	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
1504	a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7f612c73daf4620e95744c67df4ab84_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1504

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-0-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-1-0x0000000002170000-0x000000000257E000-memory.dmp

Filesize
4.1MB

Download
memory/1504-3-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-2-0x0000000000401000-0x0000000000445000-memory.dmp

Filesize
272KB

Download
memory/1504-5-0x0000000002170000-0x000000000257E000-memory.dmp

Filesize
4.1MB

Download
memory/1504-6-0x0000000000401000-0x0000000000445000-memory.dmp

Filesize
272KB

Download
memory/1504-7-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-8-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-9-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-10-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-11-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-12-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-13-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-14-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-15-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-16-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-17-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-18-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-19-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download
memory/1504-20-0x0000000000400000-0x000000000045BF00-memory.dmp

Filesize
367KB

Download

Analysis

Sharing