d86923504cf20d32c7cb99490c3b37000777d71f932f685f6be22e4bbafbf857

General

Target

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
Size

85KB
MD5

e1e788e36729db3bd1c754a160340021
SHA1

fbf1072e91554603dbf86599ad2571a513b2c6db
SHA256

d86923504cf20d32c7cb99490c3b37000777d71f932f685f6be22e4bbafbf857
SHA512

7a442471d5d5451f2fb6005ae368bb6eba299b73dd37711b4136049fc53c067786b4cbe2a038a76a5458d068508dc2c34c3b14e106940e6f718a2f60a61f7535
SSDEEP

1536:bWmBAmo4YsUvAMbRxQx+3KuKkcUoTfTH+k6dwymR:bHoOUvAMbRNKEo3HnpD

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Drops startup file 1 IoCs

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MxWeb32.exe	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

MxWeb32.exe

pid process

2680 MxWeb32.exe
Loads dropped DLL 1 IoCs

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

pid process

1868 e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

pid process

1868 e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

pid	process
2680	MxWeb32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exeMxWeb32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MxWeb32.exe

Modifies system certificate store 2 TTPs 1 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\REQUEST	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exeMxWeb32.exe

pid	process
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
2680	MxWeb32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MxWeb32.exe

pid process

2680 MxWeb32.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

MxWeb32.exe

pid process

2680 MxWeb32.exe

pid	process
2680	MxWeb32.exe

pid	process
2680	MxWeb32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe

description	pid	process	target process
PID 1868 wrote to memory of 2680	1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe	MxWeb32.exe
PID 1868 wrote to memory of 2680	1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe	MxWeb32.exe
PID 1868 wrote to memory of 2680	1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe	MxWeb32.exe
PID 1868 wrote to memory of 2680	1868	e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe	MxWeb32.exe

C:\Users\Admin\AppData\Local\Temp\e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1e788e36729db3bd1c754a160340021_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MxWeb32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MxWeb32.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabB4A1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MxWeb32.exe

Filesize
1.5MB

MD5
cb3696dc44680137c5e84838b3db3495

SHA1
9b14db1e4a9aea7779fa0af246ddfa96be418a55

SHA256
4e7315adeb47ff58e6dc86a73cfa11027c48e32f7a26fcf1e0460a9aed8c4583

SHA512
c57e6833bc2e12709b2e4225970de39acabca538ebb4f9a75a4570295d0115368b306da2616ed3cee3b73a26af8f5b3e3dc2eb4f03874ba924f99cfec87aca4e

Download Submit
memory/1868-0-0x0000000000970000-0x00000000009A9000-memory.dmp

Filesize
228KB

Download
memory/1868-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1868-20-0x0000000000970000-0x00000000009A9000-memory.dmp

Filesize
228KB

Download
memory/1868-21-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1868-23-0x0000000000970000-0x00000000009A9000-memory.dmp

Filesize
228KB

Download
memory/1868-36-0x0000000000970000-0x00000000009A9000-memory.dmp

Filesize
228KB

Download
memory/1868-37-0x0000000000970000-0x00000000009A9000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads