95558cf49cabd04fa04c66d2e33300b055e0d70a1c82c157b234b83e9ae6c78e

General

Target

c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe
Size

18.0MB
MD5

c1b1ab62df0b125126bf26bcb39b4eff
SHA1

6bcd0734779566c2ecd13983af910cf79bb38022
SHA256

95558cf49cabd04fa04c66d2e33300b055e0d70a1c82c157b234b83e9ae6c78e
SHA512

0b9811c06bd0752db32f1393025a59afe071d58e05399710273078c1219f350fa252ea82ca408b44249af6a6580aca3a8c0e7488c3b34a24fc42435de3a53316
SSDEEP

3072:G5yyXnqxHfjV2+O/iUFD2UJX3g/ND5FXZo6WV6CgMNHw:/OqJUyUV3g/Z5FX+6WV6CW

Score

10^/10

discovery evasion spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe:*:Enabled:ldrsoft"	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5052-0-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-1-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/5052-2-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-4-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-5-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/5052-8-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-10-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-12-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-14-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-16-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-19-0x0000000000400000-0x00000000015FF000-memory.dmp	upx
behavioral2/memory/5052-20-0x0000000000400000-0x0000000000412000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1564	5052	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe	106
PID 5052 wrote to memory of 1564	5052	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe	106
PID 5052 wrote to memory of 1564	5052	c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe	106

C:\Users\Admin\AppData\Local\Temp\c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c1b1ab62df0b125126bf26bcb39b4eff_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\C1B1AB~1.EXE00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C1B1AB~1.EXE00.bat

Filesize
192B

MD5
7714744020d41ca77fd4db2b862f7739

SHA1
7c613ffd7fecfa54d491a8f7f776440df76c5299

SHA256
6e1d44f28410296ef7024128950c40109a91fb53575de25f3b072b41ae55442f

SHA512
c23b0629acdfe2edbad6931951a5fd4362a7375817b924d8b1f6d0dfd8253be41fd98264ccee92f9c829466fa28b162e51bd1d41c25012a29a4f43ecf58d327a

Download Submit
memory/5052-10-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-2-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-4-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5052-8-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-0-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-12-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-14-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-16-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-19-0x0000000000400000-0x00000000015FF000-memory.dmp

Filesize
18.0MB

Download
memory/5052-20-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5052-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads