9b1cc3a28b996b4cf31882ea82219246cec4992609a7dafe9cfe6761710672a5

General

Target

09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe
Size

175KB
MD5

09d3f06ba66a7b026281debbd31f53da
SHA1

0e274348872f861dcd5ddd775545cfd13c02604c
SHA256

9b1cc3a28b996b4cf31882ea82219246cec4992609a7dafe9cfe6761710672a5
SHA512

bb984d039c2cb9d6e8c46e78588ae404ab3f5150fca299fc2b9283068356e3b7c66f1190642ab05ae99e663b88034ea40f715653f9a27296d3c0872a558138d3
SSDEEP

3072:ajeJvTHjs3ypJ7ib5tf5wExuijs1n4oCku7CgveTXs1E7/cjo:keJvTY3EiVEaXjs1n4oCkumgGAjo

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-2-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2460-5-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2460-7-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2348-15-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2348-82-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2700-85-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2348-179-0x0000000000400000-0x000000000048A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2460	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2460	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2460	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2460	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	30
PID 2348 wrote to memory of 2700	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2700	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2700	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	33
PID 2348 wrote to memory of 2700	2348	09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\09d3f06ba66a7b026281debbd31f53da_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B7F5.5B4

Filesize
600B

MD5
0d3e6ed8b8a7d3452dd5844fa2d2421a

SHA1
bbbba780dc42ea6e910a431ba1a3d6689921dc5a

SHA256
d802960dbaed0f524c8ab4b52f992807ed94eddc262b2bae8faaf8ef31e8af59

SHA512
fafcab72326f6604814bbf03e2ea6fda406d36afa7aa287e7517250da36461c5fa2874be5dc67e92b5de9d730a178e03d8b0925ca0a2027b0827fd1a4134230d

Download Submit
C:\Users\Admin\AppData\Roaming\B7F5.5B4

Filesize
996B

MD5
c0852a2882acbbc43b82b897260928f1

SHA1
4fc1e29a86a57bf261846a62a3421345067dc556

SHA256
0c68e418eb6ff14d7405f56ba4b96adfb8e1c9b0ff67fc1695ba4bb954f83a98

SHA512
8aae0bd42fda6851620cd2a46df72897566f768d1ae2db1f33c01d829e3bf63d48643339c0f6125b6c22b9dab1483d2c7533991cd5bcc03a9878c5d09d1e83af

Download Submit
memory/2348-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2348-2-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2348-15-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2348-82-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2348-179-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2460-5-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2460-7-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2700-84-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2700-85-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads