1324cdfa6a4602e5e5f8d52b646f16b46cfe517fdfd0c7f9c5cdb8cd713dfc90

General

Target

0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe
Size

694KB
MD5

0b9a38a8e4d5d6644b6381cbbafcd3b8
SHA1

c02ccd85f4614d4ea5b18dab76ce7f201e02a620
SHA256

1324cdfa6a4602e5e5f8d52b646f16b46cfe517fdfd0c7f9c5cdb8cd713dfc90
SHA512

bf998c90ddf6c177184e12365d955d0736d9b88ccc971cb0d052ed9e77a42fa835a217f0e1c57ef3b3316f3d9a699e1f04a3b378c1d16210b17082585741187f
SSDEEP

12288:t/aUsuYachgVK4RgIHfASiB3meKTC/sU0Yc9IItaWS:RaUxvxK4XHfA72eIbYc9IRWS

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Descop.exe

Executes dropped EXE 2 IoCs

pid	Process
3172	Descop.exe
2036	RnWYjCxkk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Descop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RnWYjCxkk.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	Descop.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 224	920	0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe	82
PID 920 wrote to memory of 224	920	0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe	82
PID 920 wrote to memory of 224	920	0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe	82
PID 224 wrote to memory of 3172	224	cmd.exe	85
PID 224 wrote to memory of 3172	224	cmd.exe	85
PID 224 wrote to memory of 3172	224	cmd.exe	85
PID 3172 wrote to memory of 2156	3172	Descop.exe	86
PID 3172 wrote to memory of 2156	3172	Descop.exe	86
PID 3172 wrote to memory of 2156	3172	Descop.exe	86
PID 3172 wrote to memory of 2036	3172	Descop.exe	87
PID 3172 wrote to memory of 2036	3172	Descop.exe	87
PID 3172 wrote to memory of 2036	3172	Descop.exe	87

C:\Users\Admin\AppData\Local\Temp\0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b9a38a8e4d5d6644b6381cbbafcd3b8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\start.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Users\Admin\AppData\Roaming\Descop.exe
    Descop.exe -p123456 -dC:\Users\Admin\AppData\Roaming
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\логи.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2156
  - - C:\Users\Admin\AppData\Roaming\RnWYjCxkk.exe
      "C:\Users\Admin\AppData\Roaming\RnWYjCxkk.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vlmilolzyg24061.col

Filesize
116KB

MD5
29a38d875f89f813f24d25d24ab046f4

SHA1
9f6232b12f6615dbd4000464656832b5985ab160

SHA256
130a7a47bcfbd87c1cb96884afa48b321a1c8820022e1a0a8de0ae44e68d17a5

SHA512
3dc80d88fa63d73a047bf1745b25f4e5c4929701075cba2cdf08a74fd328d5d9d145a0dbd820a0636d2426c47da0a7ab41a1280c408058cf9d2cf7fe6f4e45d9

Download Submit
C:\Users\Admin\AppData\Roaming\Descop.exe

Filesize
529KB

MD5
ce29e220137eaa81de4b08e98032cecb

SHA1
8e85a74e9ddff71bedf1e2f909a865e70e68010a

SHA256
7c77f307c7eab0ad8db790fdc065e5e1c5feeae4c823ed4d4b76c7907adc74a9

SHA512
5a6e8b28650d9659d9733c391f0670bd45ceef94fb8cc513b4574cfe3acc4cf16cd334850e63a373c10b1e455119f99c5ce48e9d22c2528566b67ab91048941a

Download Submit
C:\Users\Admin\AppData\Roaming\RnWYjCxkk.exe

Filesize
593KB

MD5
e1a37508f897388137fe8376bbc90581

SHA1
a537b28ceb41e4179b2377c4c466065ed4d1e511

SHA256
c811ce0e61e1b2529e7d9f50be3ed1adf67b640bf2332d3826163326235860b1

SHA512
d28aefc87db2cd7e496071602716754bcf009e229a4bd09beb57e5a848301228cb38061f390b195e49704d96005d72ba3bfea6bbf2f3632ceb57fac64897ade5

Download Submit
C:\Users\Admin\AppData\Roaming\start.bat

Filesize
31B

MD5
2d526503de8f0f3765ea43bfc84934ec

SHA1
a4b9fe9896876d45c63a8b8423d64b536f3033ff

SHA256
02125c7cc5f2e2920d43bd9f4654cee9bde03a03290d3f2d4d0e7710bba19c6b

SHA512
0863cbc3ec5db594e9e28613456cc792a261f05a727d45ba8de4e27c6b6be58d1807e8b5e5d789a50a8a65e8c72d867794a74bc2f2cd6cc3ff33152c627fc149

Download Submit
C:\Users\Admin\AppData\Roaming\логи.txt

Filesize
106KB

MD5
5f7762543210b662e6afeb1d98112256

SHA1
86b2e6b862c8b9c7c77558570f72287c83a2edda

SHA256
d8d36070c05a055ca13295e0343769c55278585719371c8c64dd8ae50f0937ba

SHA512
3ffdaed83de4078ccf57fe37ee2251831c53ea3192f565148a716f642680e9376febea508714e4f0280fabf7c77e6d19c864ac9a54cabeed609e5f0fb2046ebd

Download Submit

Analysis

Sharing