0256e9642f1ecc624eb007e8f40bb03413812f66c4d0a73ea75d1a1405efebba

General

Target

2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Size

300KB
MD5

2c029feed9d90387c3373163f81e21d2
SHA1

a433e3d528e9cd77121435e30cf8b19d7e467c3e
SHA256

0256e9642f1ecc624eb007e8f40bb03413812f66c4d0a73ea75d1a1405efebba
SHA512

c75671dbbc2f9ced0ec4fdf9f994fc422d3618f2f486bfe5fb3f7d4111cd4b1f17db7db1865c3de38f3403dcbd989d2bacea23a3a5f610ad7c09a57adfabe38a
SSDEEP

6144:/zmGM4OwKXZb58ftTMQaYS78qsA55j4RJ5WW2VCacIT1u:/6XDwO1ET5fqL558MW2PnTo

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
904	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1492-0-0x0000000000FE0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/files/0x0008000000023c94-6.dat	upx
behavioral2/memory/1492-10-0x0000000000FE0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/memory/904-8-0x0000000000700000-0x0000000000717000-memory.dmp	upx
behavioral2/files/0x000e000000023a00-13.dat	upx
behavioral2/files/0x0009000000023c91-31.dat	upx
behavioral2/memory/904-33-0x0000000000700000-0x0000000000717000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
Token: SeDebugPrivilege	904	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 904	1492	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	83
PID 1492 wrote to memory of 904	1492	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	83
PID 1492 wrote to memory of 904	1492	2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c029feed9d90387c3373163f81e21d2_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
606KB

MD5
fcb6760fbd0872402737f9edc3d4e816

SHA1
6b23034f03675c834690ffc7b192291fa8bf2620

SHA256
b8df1f8499d86307a8227f2cc6182f8189e4acd69b1be1499da6eebc9a6930b5

SHA512
8535f01628712076b41ed9759932e3da1a5a666b1e5d79264b75a21f19bb035ac844c8f80d420c7581682b5b9c7a01837d2d5dd26d73b7383a3d13e1cd1fe22e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iRLctAC7C8BVsEK.exe

Filesize
300KB

MD5
37fc51cf1a7154e0ca4892aedc724c3b

SHA1
e8cb8a17c4975f929d86769065327168a828b06f

SHA256
179d4f77f947523344d0e15bacfcfc730da633abca0daf6525c59b4be3b0430d

SHA512
7efbcfab36e64e470e0c36d24a564deeb3f6d7c3ec9f1cd08b8c1f253eaa89112cf077fede98867ec50c429613215067496fd61c1ba9f8460abeac11fb49ba5d

Download Submit
C:\Windows\CTS.exe

Filesize
284KB

MD5
2e1792fe63ccfb93233d85ffcb0097aa

SHA1
0c981a56bd8368a800bd33e9d290f5b7fe708853

SHA256
af153d9e6263a8269792d4b213ffd859630c3830dbe0dabad45ad31021a64fcb

SHA512
6910a4aa4d67d0a256b86e815f46eb984b4e9fdd00c4bf09c3fc75543b5433c53bf5d7d8fad42ef4aa5e8ed1256a72f080e5d624e0ab8f05ebd48ca6c5cf51a3

Download Submit
memory/904-8-0x0000000000700000-0x0000000000717000-memory.dmp

Filesize
92KB

Download
memory/904-33-0x0000000000700000-0x0000000000717000-memory.dmp

Filesize
92KB

Download
memory/1492-0-0x0000000000FE0000-0x0000000000FF7000-memory.dmp

Filesize
92KB

Download
memory/1492-10-0x0000000000FE0000-0x0000000000FF7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads