d0a305a0bb0052ec80f44da9e26b0cbd19d90cbecf4a52b44a323b68482c96b6

General

Target

a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe
Size

189KB
MD5

a8217367226771c3af3feb6d7180117a
SHA1

65efb1f84fed9c218cb55ad7211a6ad6a87920d6
SHA256

d0a305a0bb0052ec80f44da9e26b0cbd19d90cbecf4a52b44a323b68482c96b6
SHA512

ab0e3d6fa3e9d6d45e230dc5ddd54b8cb0c2cda2a15a85ed7df484cbdc84f251fc799afc67986f675c52c3b6e67f250fcc1f4f27368e2cdc057b5f3462fd47ff
SSDEEP

3072:cS6p+c/8cBCwrQlxCoSs2o/olv4PK9Xj8+q5pWiwO749/HZPWp1kMtnTHyYADL:o+aaw3s8t4C9YpWiwO749PO1k0yD/

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2564-1-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/968-10-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/968-11-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2564-12-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2300-78-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2300-77-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2564-174-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2564-209-0x0000000000400000-0x000000000044D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 968	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	29
PID 2564 wrote to memory of 968	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	29
PID 2564 wrote to memory of 968	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	29
PID 2564 wrote to memory of 968	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	29
PID 2564 wrote to memory of 2300	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2300	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2300	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	31
PID 2564 wrote to memory of 2300	2564	a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Users\Admin\AppData\Local\Temp\a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a8217367226771c3af3feb6d7180117a_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\C016.61C

Filesize
1KB

MD5
32eca73903f61e0dc4f06c5a35671176

SHA1
ccbc44f7d7b6560b7c73a1d731456c2f693b7ca3

SHA256
a519149ab6c0240710f3d889472326340f989662d19a9bb3b2a8ee16373bf273

SHA512
ddf3716da8c0484afbfba8fd180d22c06adfa3fe004b4daf34bbf2f53773bcc42d7ee1b64aaff632218b962f6f4ca540eedf92062269917ffddbf1c2e3ac8f91

Download Submit
C:\Users\Admin\AppData\Roaming\C016.61C

Filesize
600B

MD5
b3d1957b8aac955a5c768d686e26551e

SHA1
83c8673f2b8dcb57bc781468d7c11c5b7ab4a5e2

SHA256
d61a4ee2fead21ad49af46b46a07e0199d90cd967306df557e5dd5500e7f9cb9

SHA512
3bd0f1533d2a998b310a376e198bacfdcd3d2440482def31a624a6a4dd4461d95220b65901f3f2f3a85064f52654b4d60349eebcd43179c91791ac8d5965278e

Download Submit
C:\Users\Admin\AppData\Roaming\C016.61C

Filesize
996B

MD5
87d9d44c72ead9b68ead5a84990ffa58

SHA1
ca91f2d8f0d5ff0519cc0d9fa268f751deb67a97

SHA256
226efa4fb3d62f4ad525e9af7915a1905805053b17adeaea3a3fad23f2e5b6eb

SHA512
a6228b6abbccf61b08c72e1885bf78dbc94d557e0e13cf3b48cc0709cd47785685db67dbc9924896cab5f7a8b09eb8c69a6d418e010679390653d829031e9025

Download Submit
memory/968-10-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/968-11-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2300-78-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2300-77-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2300-76-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2564-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2564-12-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2564-174-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2564-209-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing