12c206735b19936ccf0dc3fc75fe394b11b4f0e7c8c66b16dd9b16f9e37b0d2e

General

Target

2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe
Size

196KB
MD5

2dfdd1f97d40651367fb64e9ba23d822
SHA1

4cc0da45c54b38e4eaef0731e583186703f7a436
SHA256

12c206735b19936ccf0dc3fc75fe394b11b4f0e7c8c66b16dd9b16f9e37b0d2e
SHA512

28f8030abc3c7c4861d1dfa339c6dd55d57c934da16e962ffffcf64e4059cee2ca382c6d2e935ecb19cafac7e27ad72edaa6148964f1ecdb1bd5abbabc2a50d2
SSDEEP

3072:FrnxbfORkwqQ8XhXiHPWEwR/KrlvbVB559MP9DWdcjkcat5xciTlF49URQs0b:Frnpx9ov8/KrlzVB7GFDCUK/xcG4900

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2076-2-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2548-5-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2548-7-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2076-16-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2076-87-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/848-89-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/848-90-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral1/memory/2076-198-0x0000000000400000-0x000000000046C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2548	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2548	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2548	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	30
PID 2076 wrote to memory of 2548	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	30
PID 2076 wrote to memory of 848	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	33
PID 2076 wrote to memory of 848	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	33
PID 2076 wrote to memory of 848	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	33
PID 2076 wrote to memory of 848	2076	2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2dfdd1f97d40651367fb64e9ba23d822_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\A61D.727

Filesize
600B

MD5
c4b3edf935a171c3590ec30265de2f47

SHA1
ca1e60f447c2c5273e77b1b625f68222bcc298af

SHA256
aaa837a8802a95489847d8baf217e380c8223cac8728390a6e5543605fe94971

SHA512
bffe07f999322d698e3246c6f396b13644a4712df3c26becf6389e19fc1d2bf589dfb6e67ace8b39886ecedbb3fc33211bddc5a4e62db44c239b8053bd3a8f4f

Download Submit
C:\Users\Admin\AppData\Roaming\A61D.727

Filesize
1KB

MD5
450af80872c47af0f870bb9b254db5e3

SHA1
1d833930910804b2c70ef48d4772f4e286f174ed

SHA256
ca2e5f7c7bf489887ddb355118bff4075bd5d5d587acb51c9b2aa5a89e136f35

SHA512
53b2adbfe8519bf5a274dafc7ec627793452dcaeaedd213b65843ea37cb8902cf0a541d9144e0befa85125dd1cd16ecd581cb1c4276e3e71299e01fb189ff7bc

Download Submit
C:\Users\Admin\AppData\Roaming\A61D.727

Filesize
996B

MD5
477a3a5facc5f743a92e441c8b5a066c

SHA1
bead7f9fc193178352975a39086b75b2b17f7299

SHA256
137bf0f17093a48641302eda888e7987d270e6c6be6385bde537789064164693

SHA512
342733a24693238bc8214bc4eaa2182c507d0646cbbc9cc98b23186f11dae43fb9c7c36b3b9cf3afd3d7b6d61f2e0315d75f19f54f0d43407391a2dcdbb8d6a3

Download Submit
memory/848-89-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/848-90-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2076-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2076-2-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2076-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2076-87-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2076-198-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2548-5-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2548-7-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads