d6003903550cee5c7f7c790dfe35a957ac5346534c0e6c706f15736ed5ceac48

General

Target

b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe
Size

146KB
MD5

b05c273e357fad57b5c6ec17381144fb
SHA1

9e13bc41c14ae855eddbd4709ec7904108bfe047
SHA256

d6003903550cee5c7f7c790dfe35a957ac5346534c0e6c706f15736ed5ceac48
SHA512

3fe82be437b55416908cf68634740df6a2a5e769f537a4e621b0c8d86f69b03c9de4284c28ce2953f9c78796d8c9dac34877b55677021275f1ad670eba5972e5
SSDEEP

3072:hAm+Juru7qm3cNmv3rOfVw6dNpNZCCl57r4sNIeQv:hAR4SBckfrO9w6d6a57rGe

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1964-2-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2152-6-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2152-7-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/1964-10-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2648-68-0x0000000000400000-0x000000000043E000-memory.dmp	upx
behavioral1/memory/2648-69-0x0000000000400000-0x000000000043E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2152	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2152	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2152	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2152	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	30
PID 1964 wrote to memory of 2648	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	33
PID 1964 wrote to memory of 2648	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	33
PID 1964 wrote to memory of 2648	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	33
PID 1964 wrote to memory of 2648	1964	b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b05c273e357fad57b5c6ec17381144fb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D090.C53

Filesize
1KB

MD5
3807d75da49d72e94a5988111057e352

SHA1
59931ef4c0ff32bb2817012453ae9cd8c9882849

SHA256
45c26e9ac809a7d8fdce974b59b6ee0e9c38cf346bbdfab6357711e76371c7b3

SHA512
6db0786ba3b09a2ce9cefea46082bd8c344910b15a43e1379077a08207a9c463c6d119ed169ec9ddcb7746a9ec5d6cacc4d452cb479a8cc45313988a6d04c411

Download Submit
C:\Users\Admin\AppData\Roaming\D090.C53

Filesize
300B

MD5
4c85441c898aaa4149c9e7201da4ab2e

SHA1
387e9ef73b796e50e39dcc4f4d9ffe645c520cea

SHA256
6c0f53eac98c5f701ad45bd47976712b8c94402abb71e8879a0722b58223a355

SHA512
55a0ecdf2fc290a5f413661e3a9609d3960bf5f7d5d1da0cb5f1b68418acb408631a3d07db293959f8f0c89a9c7388250213bf9d805d85a7aac8524a8422f57d

Download Submit
C:\Users\Admin\AppData\Roaming\D090.C53

Filesize
696B

MD5
1781d47a7a3bc0f33a88da0e1e7332f1

SHA1
0e07bc100abcb0e72746d831dbf9526b781bd9ac

SHA256
65ad6ff4f083949a9fa16b01c242cde477c5ef4c43f25483062123157592920e

SHA512
717a39ca21e19a455b1d166466c85023e5dba8bb9ce7c54c68c6c14041607f9dba190f28ad1809b458fd83f70455f59e4c15ac498ef0dfe2d01c6740a62ac219

Download Submit
memory/1964-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1964-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1964-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2152-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2152-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2152-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2648-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2648-69-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing