6ab25c0f1be036fbc2c70567efda4ef814627f50ac04361a1abf686f5ee48183

General

Target

b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe
Size

181KB
MD5

b8516be1661d969fb7ba4b6cd62ee9f0
SHA1

784d333aee9fb81d5987275d0912e1a59c8d6c4a
SHA256

6ab25c0f1be036fbc2c70567efda4ef814627f50ac04361a1abf686f5ee48183
SHA512

806f5f890220bbdc2c7578a876fd03eb7f33c489c00295a1c8907d13026f73ff583bec12af4d814a6881b8e8f2bb69370ccb5c5a8f54645b4d65ca5b4c19ac7f
SSDEEP

3072:30z+hJDGo+FDH5SJN5jF56f4c3zey5j5oi2IgVTsK8WdfYg13RqKFsqtN1cem0OV:kz+h4Bt4j34hDT5lhTgVTJd31NF560an

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2784-12-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2784-14-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3024-15-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1040-76-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/1040-78-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/3024-180-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2784	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	30
PID 3024 wrote to memory of 2784	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	30
PID 3024 wrote to memory of 2784	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	30
PID 3024 wrote to memory of 2784	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	30
PID 3024 wrote to memory of 1040	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	32
PID 3024 wrote to memory of 1040	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	32
PID 3024 wrote to memory of 1040	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	32
PID 3024 wrote to memory of 1040	3024	b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b8516be1661d969fb7ba4b6cd62ee9f0_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7BD6.A80

Filesize
1KB

MD5
3165cf6941a0e2507c4ab65531faa761

SHA1
cceaa1c961bb04508c9cbfa4e55aa28addd59f3c

SHA256
2502ef1441efb7075c7b59d5c7f0baf384ded32aab575be7385b1a21be62b4f5

SHA512
c751466a5d5afe72a3ecc3aefe1117ceaa35a6a981c6cf8fa047390e36b79c5fc7c5a9762553d9b97a03f2249333dd51127f1de436d5b1156ca0443d6d05477d

Download Submit
C:\Users\Admin\AppData\Roaming\7BD6.A80

Filesize
600B

MD5
849f643f28f6b838eecda858a5b97575

SHA1
229be7f7f9c94c038d095da956f1cd79596af01f

SHA256
1b9ba2c01b40a4bc0d60c40e356e631ff7ed8611bc52071776c46fc8dec20b52

SHA512
e01a0feda3127ede4d4a65f996ca3efb1a03063bd1b1d67edb772438af776991bf67f93524f6c6cfbaa5898290c8a754b942394863deba04d1428d4d8d89c546

Download Submit
C:\Users\Admin\AppData\Roaming\7BD6.A80

Filesize
996B

MD5
4950ee9a57b62f5055284bbb97b01821

SHA1
5107608037ec74e2f599970e3351c93316485d22

SHA256
f96b5a7914b08b6f1e7283290d863121e4fde2ff04484b89edeef8f8e9a45320

SHA512
7d34a7cb757ab32b0e6ea6558b4f685560cfd49ea8c34f6986d9aa2e3530a8bebfa29830accff438ddd2eb11aa18717b381615b395d9be271030d608f000c3d2

Download Submit
memory/1040-76-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1040-78-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2784-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2784-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3024-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3024-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3024-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3024-180-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing