b44827ecdfdef3941eb5d1fb2a4ec80ed5c641be82f395765263c51417f7d5ef

General

Target

eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe
Size

174KB
MD5

eab64b8ff2461a2711d23d98bc641759
SHA1

672527446005ea1c7c2f41469498d4a843b6cbf8
SHA256

b44827ecdfdef3941eb5d1fb2a4ec80ed5c641be82f395765263c51417f7d5ef
SHA512

ed70fc710ae643f37749c647a83222f87de8625e98157a67021051593db902e8df3e4b95884b2edd3b2d045f9c4b11443f87e3b93da4fa6b370cfcc8f3db3580
SSDEEP

3072:w7boqDmmgy4crlgG5GOwA8ftBvqaoMu72lIs0zcndcfXb:wPoqKmv4YqGyt5qa7uSnd0r

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-2-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/3028-12-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/3028-14-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2692-15-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2692-76-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2928-78-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2928-80-0x0000000000400000-0x000000000048C000-memory.dmp	upx
behavioral1/memory/2692-196-0x0000000000400000-0x000000000048C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3028	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	31
PID 2692 wrote to memory of 3028	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	31
PID 2692 wrote to memory of 3028	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	31
PID 2692 wrote to memory of 3028	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	31
PID 2692 wrote to memory of 2928	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	33
PID 2692 wrote to memory of 2928	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	33
PID 2692 wrote to memory of 2928	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	33
PID 2692 wrote to memory of 2928	2692	eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3028
- C:\Users\Admin\AppData\Local\Temp\eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eab64b8ff2461a2711d23d98bc641759_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ABD6.74C

Filesize
1KB

MD5
bedae432cfacc83e407bc29212aaf43a

SHA1
776a1aa57b61e8b1a2350e6a1fa2b090a75ccc4d

SHA256
abf581c38e9e5c57416b711463a3ebdffd39bfebf04a107fa34bb0498443c00b

SHA512
587a432c9492bd9efd1ffac355f714bf3cb82efa805e16339c6d2761c00663143e8884b4c1ed7edd6fb4f82de7fb947e347b40a263310f699920d7c73d25595f

Download Submit
C:\Users\Admin\AppData\Roaming\ABD6.74C

Filesize
600B

MD5
0ec9eda279c7ad6340608223e94acd5b

SHA1
061dcd40ab6c08c657fc2c338a0a13eb250ef6fb

SHA256
e3def4afe2c93df12b956de3850f85d96c73f7f2021a94c1309f47fcadd0523f

SHA512
5aa40615a85ea0eb812f1b8024010ec0e4c0252dc9b5e7ffac1fa3ae48069bf633c35f21e747b6b5fece0f6700229de06576d79f61e5af8696fdd2fcd28d86aa

Download Submit
C:\Users\Admin\AppData\Roaming\ABD6.74C

Filesize
996B

MD5
12774a47ea94f8c884e78556bf588592

SHA1
f98558cda244cc962409cf3478f1f9c4f112a754

SHA256
ed89100e51b6a3a0013693916e08e640aad4738086113dade2c5e335b49c30bf

SHA512
4dc53ea510d024801dba12b676668f126de4a6f9aa833d8ea0176e8308d0b639ca23f6c3890472609421e669682890860c3a4b2b9da095ab49b6bb982e369257

Download Submit
memory/2692-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2692-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2692-15-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2692-76-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2692-196-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2928-78-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2928-80-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3028-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3028-14-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads