ec25c6954d1942a38b93b3be3852ff0b9047a02ce10925439328e1e140f39df1

General

Target

06763035d7e557f1bb5388b428338198_JaffaCakes118.exe
Size

2.8MB
MD5

06763035d7e557f1bb5388b428338198
SHA1

264dfbea351977ad7e19a1f5b274046630147e1b
SHA256

ec25c6954d1942a38b93b3be3852ff0b9047a02ce10925439328e1e140f39df1
SHA512

610c8a853e7ae7af490bedd549667e655910139204c8d49e6e0f719812d67e6e74150ae7ee90c574cbcb69b02991e1fad8a5cccc35f50eeb72e0637436787afb
SSDEEP

12288:Phd/4NRod1S7X9ZjZpd1UAVYtbf8wCQqiA2fsXaTggvcsFt0sjVj:Pv/ORoPSXjx2AVYWsquf6xs7

Score

7^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2528	Server.exe
4984	Borderlands 2 Season Pass Keygen.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe"	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Borderlands 2 Season Pass Keygen.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	Server.exe
2528	Server.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2528	3488	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe	82
PID 3488 wrote to memory of 2528	3488	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe	82
PID 3488 wrote to memory of 4984	3488	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe	83
PID 3488 wrote to memory of 4984	3488	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe	83
PID 3488 wrote to memory of 4984	3488	06763035d7e557f1bb5388b428338198_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\06763035d7e557f1bb5388b428338198_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06763035d7e557f1bb5388b428338198_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\Borderlands 2 Season Pass Keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\Borderlands 2 Season Pass Keygen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Borderlands 2 Season Pass Keygen.exe

Filesize
777KB

MD5
920b5a11d3e3e0dd0d7f227f5715b505

SHA1
e93a631c8191d28a85704148b90609c7ea01f910

SHA256
3e6e4e81ee15ac8b0c04251f4d9423f83808a6ce367560da00d661578dbdd606

SHA512
1ff314fc090a061eb2a2027ace0fa5159def6fa0ded313c04ecaa0b570cf594c14d2b3d930f93b5ca4527048044dba71bfa663b407d79d90f3ce52dd51a919ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
57KB

MD5
7fa8c03bd595cb7924aab02bb1225102

SHA1
5928e2870923242440e91f3fe2a27b36959e32b6

SHA256
e4e0ddd1393c669070594aa54a0caa6f6b30cd7fe7e12de341d7dcc2edbd277a

SHA512
f5cf83602d4ea82547cf6338c6ddca5efca08f776274553d707b15f33b32b3594baf211aba4de3d2598255d2b0d003aa6df97ed3107f2b2e060f8e4fd1175cda

Download Submit
memory/2528-27-0x00007FFE17C30000-0x00007FFE185D1000-memory.dmp

Filesize
9.6MB

Download
memory/2528-23-0x00007FFE17EE5000-0x00007FFE17EE6000-memory.dmp

Filesize
4KB

Download
memory/2528-41-0x00007FFE17EE5000-0x00007FFE17EE6000-memory.dmp

Filesize
4KB

Download
memory/2528-38-0x000000001E2A0000-0x000000001E5AE000-memory.dmp

Filesize
3.1MB

Download
memory/2528-36-0x0000000000900000-0x0000000000908000-memory.dmp

Filesize
32KB

Download
memory/2528-26-0x000000001AFE0000-0x000000001B086000-memory.dmp

Filesize
664KB

Download
memory/2528-28-0x000000001B5A0000-0x000000001BA6E000-memory.dmp

Filesize
4.8MB

Download
memory/2528-37-0x000000001DBB0000-0x000000001DC12000-memory.dmp

Filesize
392KB

Download
memory/2528-42-0x00007FFE17C30000-0x00007FFE185D1000-memory.dmp

Filesize
9.6MB

Download
memory/2528-30-0x00007FFE17C30000-0x00007FFE185D1000-memory.dmp

Filesize
9.6MB

Download
memory/2528-32-0x000000001BB40000-0x000000001BBDC000-memory.dmp

Filesize
624KB

Download
memory/4984-31-0x0000000004C80000-0x0000000004D12000-memory.dmp

Filesize
584KB

Download
memory/4984-35-0x0000000004E40000-0x0000000004E96000-memory.dmp

Filesize
344KB

Download
memory/4984-34-0x0000000004BF0000-0x0000000004BFA000-memory.dmp

Filesize
40KB

Download
memory/4984-33-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4984-29-0x0000000005190000-0x0000000005734000-memory.dmp

Filesize
5.6MB

Download
memory/4984-25-0x0000000004B10000-0x0000000004BAC000-memory.dmp

Filesize
624KB

Download
memory/4984-40-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/4984-24-0x00000000000A0000-0x000000000016A000-memory.dmp

Filesize
808KB

Download
memory/4984-22-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/4984-43-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads