0e30066a1dab047fc719344e3e528d47646faa535234d3dd3967e95626db0985

General

Target

0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
Size

186KB
MD5

0e93d991911d94fc82be30a0ca66dd38
SHA1

042132276754a96359f2a4dc88367db367dc4f92
SHA256

0e30066a1dab047fc719344e3e528d47646faa535234d3dd3967e95626db0985
SHA512

ed70faa7b2f1e5b49b11d1ea2509cdd9b4f7fadbc5fa8d82a1804c979618f24991aac9bfb6c63dc35ecc70c06fd654cc1871d00215492387350102ee3714ecbd
SSDEEP

3072:pTcVc70Qt2rySj6dAZiHVapcU0iPawr0CvI2eZZ9AAFHZyOSMZ0eUDOT4nOLqWP:pKcIQYe8jcMpIPOXIjZZ2ApMxMy/yqW

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process
PID 2384 set thread context of 0	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
PID 2376 set thread context of 0	2376	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
PID 2780 set thread context of 0	2780	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2384-2-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2376-5-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2376-7-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2384-15-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2780-78-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2780-79-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2384-80-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2384-137-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2384-186-0x0000000000400000-0x0000000000443000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2376	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2376	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2376	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2376	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	30
PID 2384 wrote to memory of 2780	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2780	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2780	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	33
PID 2384 wrote to memory of 2780	2384	0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\0e93d991911d94fc82be30a0ca66dd38_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\B56B.000

Filesize
596B

MD5
c11c853e63f11b0b60b012e1ab8a1de8

SHA1
3fc1470023e8938d062bc16f572be6cd1e17327f

SHA256
7f73eae28a757474a8437496799089b1ed0b4019e0729fde8e730475d0ab9a29

SHA512
0e8d937260055e3f4e80e6a5a77d43ba4810cccf44794a8624bfde2eac19013d862c5e27bced66381997b2f46b4e27c737df00868f95bc2dbac940fdc0e6fe4d

Download Submit
C:\Users\Admin\AppData\Roaming\B56B.000

Filesize
1KB

MD5
3004846d1458a48107e6fc4d36882128

SHA1
be1fb780efa3b9f0e6bd4f3d45a7716796c867c3

SHA256
e052fa1931034cf0f977ab75b3805565270d1a5e7af1939af9a1a66ebb91a8f7

SHA512
e13f07ef227972c3e77149e278d599b11fd807ed2709339a003330b77426d4195bef209d7612d041ba0f9eddd2326991cc1f6217971a155a680c32e672806f53

Download Submit
C:\Users\Admin\AppData\Roaming\B56B.000

Filesize
600B

MD5
7b65ada176bf25bbc7a10d0c5574d4fd

SHA1
d9a04e69e1e85410f58acfa74b2f94add16d2409

SHA256
893d4b8a3bb1c89300de9c9b9a9a9c5c5253d7fbf63e1785148f92ed6db4bcb3

SHA512
7272229abb3692cb5558e30b61b5a139c799dc1332720bce07d050bdb7a8f9d61d0c557e13e53c8415054490e2a46d4702aef445480aabddd6887417daf47681

Download Submit
C:\Users\Admin\AppData\Roaming\B56B.000

Filesize
996B

MD5
767a6cb675bb9982b57b550104018401

SHA1
f6f23f77c4af0c087746abf9b154bd4628dcefd0

SHA256
5644fdbeed878bcd5e721fdbd352ba3d1a2987c8a1f20038b35c6a7a45aee791

SHA512
6cdb13dcab3535ac8ad2ecd6c0c7d9fc198c0e98afd9d1d1125799069addefdc0eefc0de69f285b0420cdac2e8e6795eb31cedad5d9e3a2ea07e0abe0f3154b6

Download Submit
memory/2376-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2376-5-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-137-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-186-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2780-78-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2780-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads