930815ddee6e081b4aee491bc36916634a9bff79fe412cea01163bb848e39b32

General

Target

da498be635503676449213ed619c6dc6_JaffaCakes118.exe
Size

167KB
MD5

da498be635503676449213ed619c6dc6
SHA1

be5f5d8edb160a48dd92760536f2410fd3b9b85b
SHA256

930815ddee6e081b4aee491bc36916634a9bff79fe412cea01163bb848e39b32
SHA512

c0a87bd7eab349ba4d5728caf1adc6649f510870354c219d968829ab0aed4fcc9f85be28cbd7de33fc5f982f6cff9e6c5983527b9c1a2a18cad21ac18afb06f7
SSDEEP

3072:jPD71ztDo35yC7qgPU4dHn3vmL/YupHw/cIS21gvwxoZZZ:jPt23g1A3vmLgupQ0AnxoZ

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2708-2-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2856-5-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2708-8-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2420-72-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2420-73-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2708-125-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2708-159-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	da498be635503676449213ed619c6dc6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da498be635503676449213ed619c6dc6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da498be635503676449213ed619c6dc6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da498be635503676449213ed619c6dc6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2856	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2856	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2856	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2856	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2420	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	32
PID 2708 wrote to memory of 2420	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	32
PID 2708 wrote to memory of 2420	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	32
PID 2708 wrote to memory of 2420	2708	da498be635503676449213ed619c6dc6_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\da498be635503676449213ed619c6dc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da498be635503676449213ed619c6dc6_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\da498be635503676449213ed619c6dc6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\da498be635503676449213ed619c6dc6_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\da498be635503676449213ed619c6dc6_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\da498be635503676449213ed619c6dc6_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\32A1.E10

Filesize
300B

MD5
d39d8bc82134b14c3feb269a2e872b86

SHA1
dacd71f049b14719ec91c02ec1eb1558a5ba38dd

SHA256
db45356f365f1b6787441e40380bdc9ee6fe76d8f56e9e28e30f9821b4b8acb2

SHA512
6cd9f5512788450d389d1582832fd0a3ecd9091d5d6848baac7d19b3551af1775ab986ef4672d2d21c020b36a5af0ad5ba558a368dcadbd332d473e6e56b4f4f

Download Submit
C:\Users\Admin\AppData\Roaming\32A1.E10

Filesize
1KB

MD5
37b1e9245978cbc19395d6d67f41acc1

SHA1
ddbcd0f96fc756f2ca2e89890e79b338d07648bb

SHA256
094db0d5811ea1c983cac3dce196ce187b85a67a0e35786f22561d9651deac4e

SHA512
8e739252e28ddff25dc6cded7c419aee54c22986dd2b6c68f895891435f6e3cb168a8b588b39ce31b79449eca85775f8b5e0f426c05b5b586aea092f1a411861

Download Submit
C:\Users\Admin\AppData\Roaming\32A1.E10

Filesize
696B

MD5
28adb6ca7f5306a07b3817e123bfa771

SHA1
30ba21624780cf7880f72ac40fa1689b54be4ccf

SHA256
76918423ca2bfecf90a18ed0f3e83be4f5f91151ad70aa0afa8caefceaa7b39c

SHA512
c5fd899b4bbdccefd16e72bc0a1fb4c0973c4e27a58bcfad11b9dd37e4d1ce26a11f5477be718f8cf0997b79f10be35f9312381aef988c5cd8bbf9444e8550dd

Download Submit
memory/2420-72-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2420-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-125-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2708-159-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2856-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads