02b2e1156799d4363d2ad41be0b0a86a3b4c00cd46e5116ef2228be286943231

General

Target

184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe
Size

104KB
MD5

184ee301271bf5f02f3bc0f7562ebfb5
SHA1

b41a7699440dc7634fbdbc84da3736934db0732c
SHA256

02b2e1156799d4363d2ad41be0b0a86a3b4c00cd46e5116ef2228be286943231
SHA512

ce50383f4ffb92917074babe829f1ff0af7e66f1228ab8fc6749e3c9546dcbae34c1da7af2ec8604c1dfc602b450f0a001a612784e2fd05b90fcad2bdad2f736
SSDEEP

1536:iNZQViNWlxCdkd9Z69g2Tleyhe9kmHRubWVU08isx89BDMVcohCW5GOKd2N/Vp8j:ImGdkTZtYlRhezHRuO7Z9BDAhbSk

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\shell.exe"	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2788-2-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral1/memory/2744-4-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral1/memory/2744-3-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral1/memory/2788-6-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral1/memory/2764-10-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral1/memory/2764-13-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral1/memory/2764-12-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral1/memory/2764-9-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral1/memory/2788-8-0x0000000000400000-0x000000000047C000-memory.dmp	upx
behavioral1/memory/2788-50-0x0000000000400000-0x000000000047C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2744	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	30
PID 2788 wrote to memory of 2744	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	30
PID 2788 wrote to memory of 2744	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	30
PID 2788 wrote to memory of 2744	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	30
PID 2788 wrote to memory of 2764	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	32
PID 2788 wrote to memory of 2764	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	32
PID 2788 wrote to memory of 2764	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	32
PID 2788 wrote to memory of 2764	2788	184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\184ee301271bf5f02f3bc0f7562ebfb5_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
396B

MD5
ccd55d3bce29174c59e43cdd0e7d5e38

SHA1
5388cde064cfed474a8bfd18325f15826afb5cd5

SHA256
e48224323ec33d27169aa5f7048ce9179e78d9b9df48a0f13ea6e9f31450c9a7

SHA512
92164f7b65bfd5052ed8fac315ebd57d5e59a77ec2c12c722f4b12d26838b564500396c50256f4756ece93786a3fdddf02174589db144ae8a2e181de71af2c14

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
792B

MD5
cdee92c5961c56ed7678a79084238844

SHA1
3f7c012a29b5cbc81d6a1cac11adbdad396e16b2

SHA256
218f65cdb35e1b82f13aa80f516b500387e3a25760fffdd99e72fb55cbc973e3

SHA512
b61deee81b5093da110b06c8b87e9f2cb6fae45c6aac1de9f2748e446031e49edbd19af5c9c0fa6ac68280c9ccb181ce7d7aaac38392761d896ceb0b2ee4d051

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
1KB

MD5
3720c8d65a834026e3e5c72292ed21ed

SHA1
171f74aa7e8b8c17970ec1e533170af87fea9cec

SHA256
c101ecb786d411fe5ea7d128ce37b213d8c253e429e289e777ef2a38ed0ecd32

SHA512
941cc9978900f126e8a94d3f8b62f8d4884a68d17ffa56e59729337efeb10cc5ee12baf0d33bf025f4088770a1f25a215964cb0dc1cb93291cfda4158f3b2b25

Download Submit
memory/2744-4-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2744-3-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2764-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2764-12-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2764-9-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2764-10-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2788-2-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2788-8-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2788-6-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2788-0-0x0000000000260000-0x0000000000279000-memory.dmp

Filesize
100KB

Download
memory/2788-50-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads