84221f17d151229e7c2868e3522280b6876deadf05fb0a4be578754d85d1cb60

General

Target

ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe
Size

193KB
MD5

ea77ebea844bef64eba2dab528260168
SHA1

e7611a05b5b2d8add3ee118afd55d6927a796494
SHA256

84221f17d151229e7c2868e3522280b6876deadf05fb0a4be578754d85d1cb60
SHA512

96fa77b7966fb159a6575cb48c43f5153b0b7194d444ed01c21d72fc59bc95245852d222c45b45b6a5e78549ec4fb9ead2872de22989b5cb456ffd5827a1c79e
SSDEEP

3072:DC1X1CPPcoVGNkzCPAUCTYqicI+NP8G4s2EdoIP3Vd6v6taHzAAOk0kLA/xz0ga8:shZSrUavZ7hG64U3k0/h0g

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-2-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2052-5-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2052-7-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2060-15-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/3052-80-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/3052-78-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2060-81-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2060-175-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	30
PID 2060 wrote to memory of 2052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	30
PID 2060 wrote to memory of 2052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	30
PID 2060 wrote to memory of 2052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	30
PID 2060 wrote to memory of 3052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	33
PID 2060 wrote to memory of 3052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	33
PID 2060 wrote to memory of 3052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	33
PID 2060 wrote to memory of 3052	2060	ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ea77ebea844bef64eba2dab528260168_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D7FD.CB2

Filesize
1KB

MD5
e6e4eb70bed6155f38fd4e5c6ffea277

SHA1
e0871eeae6da969c4770bef4ad58680b5a1be0a4

SHA256
fdbd26d2c18db6d22c3f9791b35e763835682ef22377c9a5d0b103ba0a36b091

SHA512
09e7e138d7554b6e8b81660d4dd3370750dfb37738acfbd711a1fbb07f27e0c858ca103e84b2887ea78968eddbfe2d25b7466e2670702da1bba6f0de17304fef

Download Submit
C:\Users\Admin\AppData\Roaming\D7FD.CB2

Filesize
600B

MD5
6931b2abb323fcd7aea752c7bf08e3e9

SHA1
c6ec27deee31131509319d4ad91f82c9f227ff3c

SHA256
21a7d01266a407460d94bee49574d210368d66c09172868f600f05154d62a30b

SHA512
dc31e3ba8dfb1b8148846c47b22305b1b035df0ba81c3294b8876b75a038aa7608ec000eba7e6fef9f8ec23929d4bc0c7a75409e2841a4720bbf905119c62c61

Download Submit
C:\Users\Admin\AppData\Roaming\D7FD.CB2

Filesize
996B

MD5
5a66218950e97db1bac8278b8e1fbd46

SHA1
0c7c07dc196dd40a16ab10e1769656cc1ce367c8

SHA256
b450aaf017ec92b24b0922522ff9fb1d7c650caa07904a538586c6a64eec2860

SHA512
3aa79c435b2db0a6aea759f28436d3f2c2247ddbe39a81563f6f5b4f38dc5304590fecfa9d976d720683c20bd5ef574e4a126dd7eed563284566c94f8b1cb71b

Download Submit
memory/2052-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2052-7-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2060-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2060-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2060-15-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2060-81-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2060-175-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3052-80-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3052-78-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads