165ffc52aa45cdd400656ff0829d18b99bcf7b247d6a93a91cbde31ba9191966

General

Target

ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe
Size

169KB
MD5

ecb88a32e6174ffcac324f426386c19d
SHA1

720b91f52321520aa8bb4848263f4c57978d2113
SHA256

165ffc52aa45cdd400656ff0829d18b99bcf7b247d6a93a91cbde31ba9191966
SHA512

aacc79e4588a1e826539430a0c0abed22bf794a2ebc8c617983adbbee802b8567c736b7137de332e309ec7ae6520038b8bd13008d46ad5672cb98bd32bc77481
SSDEEP

3072:LZmbrfs02fhQkH5m65IDRyCKsODyK5p3dcXGbHIefzp58yXkmhRwAQ4ckIcI/SAC:Mbg56k4fRyCLO+K3qcHIi15JlZI/SAC

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\BB8F0\\DC526.exe"	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1392-2-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2604-15-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1392-16-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1392-17-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/1392-79-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1108-82-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral1/memory/1392-188-0x0000000000400000-0x0000000000491000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2604	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	28
PID 1392 wrote to memory of 2604	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	28
PID 1392 wrote to memory of 2604	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	28
PID 1392 wrote to memory of 2604	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	28
PID 1392 wrote to memory of 1108	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	30
PID 1392 wrote to memory of 1108	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	30
PID 1392 wrote to memory of 1108	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	30
PID 1392 wrote to memory of 1108	1392	ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe startC:\Program Files (x86)\LP\26FB\C98.exe%C:\Program Files (x86)\LP\26FB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ecb88a32e6174ffcac324f426386c19d_JaffaCakes118.exe startC:\Program Files (x86)\F0165\lvvm.exe%C:\Program Files (x86)\F0165
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\BB8F0\0165.B8F

Filesize
1KB

MD5
f93c5ee758c806fd2dea0f74b0c97b6d

SHA1
d4c1d0d9d1738d1fa1da57a803887e779eb82612

SHA256
1ec2752077c3c314a54f56e60659af624b80b6f2c4f6fb76bbaa6bd7865bb61f

SHA512
df2f57b0a7e914845b5efc441b09e0b27d0f8b562d4573ea616d7782f2f930f1bda09f9536a7956aab1b47a8c4ef0822ba5af917f0431f213371c1461ce22478

Download Submit
C:\Users\Admin\AppData\Roaming\BB8F0\0165.B8F

Filesize
600B

MD5
381ebe5994cf69e3a86bb92c68ef8289

SHA1
3f5a1e555528b4bbaf6c1781e63242caf28ac4f6

SHA256
c735ff7ad8b1db33da35e5d791a5ad96ea57b1e94b0b9288541c4e32c1cb72de

SHA512
a0978905d4b77f81c9f4e6ada7be02add21ea5947ccb65ca844d304e60179955f0637506db04d9ffbd4251732cb287000c1d8825338b32b8bc37665ccbdf281f

Download Submit
C:\Users\Admin\AppData\Roaming\BB8F0\0165.B8F

Filesize
996B

MD5
385002afa265534384e28ad16416d9e3

SHA1
5cf673943afb3c304e9b19156a6a481bc2d5e031

SHA256
29e2bbc2b4e2320d5785eacaed6ed7cc3f3ac634920ed91528e7e98c1727b0cf

SHA512
b3dffb12344fd996a0dbfe6c98a301d14d7afc8a08e4640d38fc894919bfc1efac1617a8d76f26259e05254167b2b9e23a40119af9a12c595fb83972143a878a

Download Submit
memory/1108-82-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1392-17-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1392-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1392-1-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1392-79-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1392-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1392-188-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2604-14-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2604-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2604-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads