52707293ef54fd249e7ee7354e93635ad48e4ce607616076bce73cdff475e959

General

Target

a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe
Size

168KB
MD5

a9f5a45841abe45be2fc6fd8f9cd028f
SHA1

ab90c743ca90b6bd4c0817977ed492af46c74091
SHA256

52707293ef54fd249e7ee7354e93635ad48e4ce607616076bce73cdff475e959
SHA512

a9108d1ef712efa5b2171a008775a1fd62aa4c7b0ab191636602f7e247ea7c1ce2cbc7276675cfb8bca79cfa69ab7c8acd6fb226afc682d1508a5387b548abd6
SSDEEP

3072:k02RCXtj4OB2EEkxjtiLz00T1pOYvcEr4SF6Evm3b2syXxAP:n2QdR2qxjtiX00hcE5xvUHyhK

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-2-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2740-12-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2740-13-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2848-14-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/1624-77-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2848-78-0x0000000000400000-0x0000000000444000-memory.dmp	upx
behavioral1/memory/2848-152-0x0000000000400000-0x0000000000444000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2740	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2740	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2740	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2740	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	31
PID 2848 wrote to memory of 1624	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	33
PID 2848 wrote to memory of 1624	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	33
PID 2848 wrote to memory of 1624	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	33
PID 2848 wrote to memory of 1624	2848	a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a9f5a45841abe45be2fc6fd8f9cd028f_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\02E7.965

Filesize
1KB

MD5
1aaefcffdd2422978dc54cf4b97d2fc9

SHA1
2170fc7924cbc51c84adc93a15881ab0496ac3b1

SHA256
dfb57acde0825d36e1b57e9fbb3fd681abb11299c6a4eac8a8b0739ac737c41a

SHA512
b6505f32fa3f8c064fdfa1c8410bddae0b4cf5025a5b398ace503a640bc574968ff82a3ad92bb919ddc801f0be35501c3925b5957d330812772ab9f0037de72b

Download Submit
C:\Users\Admin\AppData\Roaming\02E7.965

Filesize
1KB

MD5
8322cf92a7f514798e5ef4eaed12dde7

SHA1
f7a20ea697f29d6b18ffecfed19b9753acf9f42f

SHA256
cc71f56a6b252da60d4e832c6c583e2a453aa61292cbdef4cc4874d9c6919bca

SHA512
70e99c9c41c6ae9a43bd4f5eb09ecb223fdbee77eed447609824a5f1ed8d7ab5aeb306ed2ed90c27f7dab1afb9fab8f46316f2c913f509c1d33bf5717664505a

Download Submit
C:\Users\Admin\AppData\Roaming\02E7.965

Filesize
600B

MD5
d5452ce54cde731d057aa870bf987db6

SHA1
6a8e620c2cafaced754999dabd3a47ec1fb93a5c

SHA256
d3ac72237012f7433d86153fbeca2cc063e49a942caed3f672a81b7ef6993e05

SHA512
237022e8c11a9bbb727f675f207b6f6363560a04f75255eb818de484532ca629e0ce8d81464ea2594223d2dd8de84ef391d73d84c49292606757c0dbace902fe

Download Submit
C:\Users\Admin\AppData\Roaming\02E7.965

Filesize
996B

MD5
5c590d086c97bd666d2762bd4c6ab86d

SHA1
76683e55cce64de854920d2291e2310e6909f746

SHA256
4140ae3b41da87eb91d216ed6095be6a0e16783f11e1fdedf7701f9edc3cabc5

SHA512
d388c7c6161f0cef11a6c8b90114d7b82036f492a14e7c96118ab45b8cc027dade3a1f3d7137ee56879fa888214149cdcc7e2658db87de294325241633b563a0

Download Submit
memory/1624-77-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2740-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2740-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-78-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-152-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads