a936b028a289062f40494e01c20bd7615dde865579e9499f70aa6cfa1a3b903e

General

Target

fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe
Size

163KB
MD5

fa09f35f840cc96b70747b91353edb04
SHA1

5ada08b9bef11b45c305c18b7ef175ba1588b8d2
SHA256

a936b028a289062f40494e01c20bd7615dde865579e9499f70aa6cfa1a3b903e
SHA512

a31a98771240d34df48e0d1bfbe98cd0fe72385bad0091798a9ee957bfdb637ca86969b873f6d85c130affcea45ce7b56ae3caf7dfaa25c2776e79258aa5bf37
SSDEEP

3072:MtdZxmbxsJNiIufJ0KWVHEinjGqd6BsKI7ifNCSAUT:MtVmiKVfs9JGnpI7iVv

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-2-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/592-5-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/592-7-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2112-15-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1104-86-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/1104-84-0x0000000000400000-0x0000000000468000-memory.dmp	upx
behavioral1/memory/2112-199-0x0000000000400000-0x0000000000468000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 592	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	30
PID 2112 wrote to memory of 592	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	30
PID 2112 wrote to memory of 592	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	30
PID 2112 wrote to memory of 592	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1104	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	33
PID 2112 wrote to memory of 1104	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	33
PID 2112 wrote to memory of 1104	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	33
PID 2112 wrote to memory of 1104	2112	fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:592
- C:\Users\Admin\AppData\Local\Temp\fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fa09f35f840cc96b70747b91353edb04_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B31A.B3B

Filesize
1KB

MD5
e1941389c1a87d0c6b27bc65fa58f3de

SHA1
b25148a4933d5852a66a73d9884707700499355d

SHA256
0592f4e29a43d5b10702cd7ab2afa55685537e1127210788568faf0b9edb2826

SHA512
27d508b34a89cc2b5d25968ebc3f387d057ea35e7bb5fde01154049b6f608fd8bf0e1afb62e93d27321b974cff75f1c424c6d478e3e5343549c7126fea671a08

Download Submit
C:\Users\Admin\AppData\Roaming\B31A.B3B

Filesize
600B

MD5
8caf551a4052de653ed276f10dfb783e

SHA1
cd332e782aa42d467541554ec7231a0b3607ade6

SHA256
140fd930c18b6239c6bee4fc66d1bbf47299972907e20420961dd4a74ef2dade

SHA512
3014829a3876bd6541b01ba9e29ec112f8a83b4f01d8f2de116fae9825def0f310ae4a2574522a20182085a1074f506d108676f4d8fa7add22083948595b8449

Download Submit
C:\Users\Admin\AppData\Roaming\B31A.B3B

Filesize
996B

MD5
3cc299e44900ddab9e750497251bae41

SHA1
cb9f1722366b20f0df65b3f0a8edb8a09ab785f6

SHA256
f0e5629dccfd9292b3119038df71327b9eb5a429148b0e50a36f4a8931cbf9e8

SHA512
e51c6803f6845db0e63e5440eacdc5d2190a1921a131041d6da6d6a9f4b9048eaa29d745b05b88717e32bf9778620e3ac74f8df9e8417ca2141a54f79d3dd1c7

Download Submit
memory/592-5-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/592-7-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1104-86-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1104-84-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2112-2-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2112-1-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2112-15-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2112-199-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing