1b96ddd4a19004fa569d13b757b40f6278d1286b3de0b44461ea01baa8830f4b

General

Target

bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe
Size

167KB
MD5

bfcb9a484c392ae8accce6d9e798b902
SHA1

ff8be2e2883afc3f7fad9aa1dadbe03e778286ad
SHA256

1b96ddd4a19004fa569d13b757b40f6278d1286b3de0b44461ea01baa8830f4b
SHA512

5a615d3c2cc6b1619d0b6dfc5a6b47bf7c3c57097264c0bed3485122127c46b5b91dd01bb9ab003ec2fe6d86e1322f701d6fd26124a5979585135601a5984e76
SSDEEP

3072:T9ckJJbdeFHUFOdmrJtFeUY9zCSdtgpkBehaOunkfJ7tEKNzlgYhlQQB3+sf:TOkvhEAe9+tbonkxtzBhay3Tf

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2312-6-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2312-8-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2508-16-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2508-79-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2660-81-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2508-189-0x0000000000400000-0x000000000046A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2312	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2312	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2312	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2312	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2660	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2660	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2660	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2660	2508	bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bfcb9a484c392ae8accce6d9e798b902_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BCEE.044

Filesize
1KB

MD5
8b1a988c91b588671e503a1bac92f142

SHA1
0982b76de6df169cd8add9637093f4ab40a93718

SHA256
ff8becf2955e9879f616f86f71203c0460382d24d95cd6a177e0889b31034931

SHA512
ce249314bf9bfe75a5ddc3721185bd1d3de2032ecf745547c5a5bac481a72cff75abe367a3d10d141681cb3f5a8b4aacdb307df41d51b7af7d29c7b3d2e23a1c

Download Submit
C:\Users\Admin\AppData\Roaming\BCEE.044

Filesize
600B

MD5
a2b692b3db358b245ce6839c1144ddbc

SHA1
838495a13d9af6faf614dbc998685f13f5f83d90

SHA256
b8a8481ad3613211da79fcacacdf421e9f50c5cfc3c54dab95a44031fab464c0

SHA512
b823d92157522fe40ef597fc1eb89d426c206bc25a40b13b01b2ba8da109be185de7887db2ad3caf0ccb0411a0b98a4f302344ff7ff0c099ed7d9bd82bf5c0e0

Download Submit
C:\Users\Admin\AppData\Roaming\BCEE.044

Filesize
996B

MD5
7e88c1657883561a7196c5e66e00e82e

SHA1
7345e610afe599d47222dfefa784aa146f927c73

SHA256
7bb469c51b0d66d1b2af36c2bcbf676f6dd4656b3e23f093d5b206bfd952e5f0

SHA512
343e760e97ef04302f55a97e2d4e444c9de0fe2b9762bb9f2b0b739f5fd98119f1b3e7a10e3186cc6c323de2cc9b5169fc1e92c12ebf72feba7fe27d3361c556

Download Submit
memory/2312-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2312-5-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2312-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2508-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2508-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2508-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2508-79-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2508-189-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2660-81-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads