0256e9642f1ecc624eb007e8f40bb03413812f66c4d0a73ea75d1a1405efebba

General

Target

2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Size

300KB
MD5

2c029feed9d90387c3373163f81e21d2
SHA1

a433e3d528e9cd77121435e30cf8b19d7e467c3e
SHA256

0256e9642f1ecc624eb007e8f40bb03413812f66c4d0a73ea75d1a1405efebba
SHA512

c75671dbbc2f9ced0ec4fdf9f994fc422d3618f2f486bfe5fb3f7d4111cd4b1f17db7db1865c3de38f3403dcbd989d2bacea23a3a5f610ad7c09a57adfabe38a
SSDEEP

6144:/zmGM4OwKXZb58ftTMQaYS78qsA55j4RJ5WW2VCacIT1u:/6XDwO1ET5fqL558MW2PnTo

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-0-0x0000000000110000-0x0000000000127000-memory.dmp	upx
behavioral1/memory/1728-9-0x0000000000110000-0x0000000000127000-memory.dmp	upx
behavioral1/files/0x0008000000017403-7.dat	upx
behavioral1/memory/2696-12-0x0000000001250000-0x0000000001267000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Token: SeDebugPrivilege	2696	CTS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2696	1728	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2696	1728	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2696	1728	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2696	1728	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\REwmZQaocDMr1Q6.exe

Filesize
16KB

MD5
0609bc2d68501fa7a7fbf76836c004eb

SHA1
bbdd32670dad2bc8bc4687b9ab867d56007ec686

SHA256
98886318582fc213987bbe76ea66518d525793abe753138178ebdf44c69697f4

SHA512
21ee474f36c6cb42f4a4bd8fbfd959708343bad96363cd0a7b0ce08631e0105ccdfa4ba01a79309b3e3344e66080be7e3f7967b46da39816b5aaacaaa7d41afb

Download Submit
C:\Windows\CTS.exe

Filesize
284KB

MD5
2e1792fe63ccfb93233d85ffcb0097aa

SHA1
0c981a56bd8368a800bd33e9d290f5b7fe708853

SHA256
af153d9e6263a8269792d4b213ffd859630c3830dbe0dabad45ad31021a64fcb

SHA512
6910a4aa4d67d0a256b86e815f46eb984b4e9fdd00c4bf09c3fc75543b5433c53bf5d7d8fad42ef4aa5e8ed1256a72f080e5d624e0ab8f05ebd48ca6c5cf51a3

Download Submit
memory/1728-0-0x0000000000110000-0x0000000000127000-memory.dmp

Filesize
92KB

Download
memory/1728-9-0x0000000000110000-0x0000000000127000-memory.dmp

Filesize
92KB

Download
memory/2696-12-0x0000000001250000-0x0000000001267000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads