490231c470c5d3bf62541b06b2e7e17fe7bc55d7eef80b69b45095160fca186d

General

Target

ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe
Size

69KB
MD5

ee303fa9a87acadf6998b9b9948fabd7
SHA1

4178c174a836fd75df2649b27c11850bba47f5aa
SHA256

490231c470c5d3bf62541b06b2e7e17fe7bc55d7eef80b69b45095160fca186d
SHA512

9bc1213fb338b3df2144c9fa4aeebe8d826152a6a3aa244d92e1e2ca684309d25d38fdbcbe62adea3670b8cb0b08229a704116c246a0b4d44d0c8d0566bbf3c6
SSDEEP

768:gG3n6aK61SPSWftfTTzPAon1vFp4bJhxdlUCm2Oo2Oo2OV:gGEiGzP/1tpgJhxdlUCnO5O5OV

Score

10^/10

discovery evasion spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe:*:Enabled:ldrsoft"	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2892-1-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-3-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-6-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-8-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-10-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-12-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-14-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral2/memory/2892-17-0x0000000000400000-0x000000000051F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 4836	2892	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe	93
PID 2892 wrote to memory of 4836	2892	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe	93
PID 2892 wrote to memory of 4836	2892	ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee303fa9a87acadf6998b9b9948fabd7_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\EE303F~1.EXE00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EE303F~1.EXE00.bat

Filesize
192B

MD5
215a2302609cf38f4d0a332dd81a678f

SHA1
02f1bb28a39356bb802c64bead25e31042586176

SHA256
21230b14f70ac3197f9bb979a71263afdceb5623e4c7d392b1298912a515cfa8

SHA512
9517ab08d3bcdb1505521bfafef98e6f065227186af89cbe0083d8e440f4cef2c57a46044ec0b3a327bd5a806b980ca148912ed616a646bcd18476840373cf8c

Download Submit
memory/2892-0-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-1-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-3-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-6-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-8-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-10-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-12-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-14-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2892-17-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads