3f95e86177b4222eaf09a4c451b182acad6c6e29bf36faa3b218a458ad17edad

General

Target

46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe
Size

905KB
MD5

46451438f62fc2ffc83703e9f88cdd94
SHA1

51e4daaedf0bc971f12890ef62b97e74099a212f
SHA256

3f95e86177b4222eaf09a4c451b182acad6c6e29bf36faa3b218a458ad17edad
SHA512

23a95a91e2d387483d91c9466af9a09afd2f40a82e62ab18acada554c0c168a151495197669791e6fedc00aa40e069658a0f9b7141c4e15a91fa44119ca7fb04
SSDEEP

24576:/bWLyQvtTXOVbNVkrQ6yS5djZrnVKta3EKvA:/MvtT+xkZ1T0ta3FA

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3228	Y0FY4JXWwIkRvJP.exe
3044	CTS.exe
4336	Y0FY4JXWwIkRvJP.exe

Loads dropped DLL 1 IoCs

pid	Process
4336	Y0FY4JXWwIkRvJP.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1256-0-0x00000000002E0000-0x00000000002F7000-memory.dmp	upx
behavioral2/files/0x000b000000023b65-8.dat	upx
behavioral2/memory/1256-10-0x00000000002E0000-0x00000000002F7000-memory.dmp	upx
behavioral2/memory/3044-7-0x0000000000FE0000-0x0000000000FF7000-memory.dmp	upx
behavioral2/files/0x003c0000000234cf-14.dat	upx
behavioral2/memory/3044-89-0x0000000000FE0000-0x0000000000FF7000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y0FY4JXWwIkRvJP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y0FY4JXWwIkRvJP.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe
Token: SeDebugPrivilege	3044	CTS.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 3228	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe	84
PID 1256 wrote to memory of 3228	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe	84
PID 1256 wrote to memory of 3228	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe	84
PID 1256 wrote to memory of 3044	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe	85
PID 1256 wrote to memory of 3044	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe	85
PID 1256 wrote to memory of 3044	1256	46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe	85
PID 3228 wrote to memory of 4336	3228	Y0FY4JXWwIkRvJP.exe	87
PID 3228 wrote to memory of 4336	3228	Y0FY4JXWwIkRvJP.exe	87
PID 3228 wrote to memory of 4336	3228	Y0FY4JXWwIkRvJP.exe	87

C:\Users\Admin\AppData\Local\Temp\46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46451438f62fc2ffc83703e9f88cdd94_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\Y0FY4JXWwIkRvJP.exe
  C:\Users\Admin\AppData\Local\Temp\Y0FY4JXWwIkRvJP.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\Temp\{27859E2E-843D-4A8E-AF95-52524B68A0B7}\.cr\Y0FY4JXWwIkRvJP.exe
    "C:\Windows\Temp\{27859E2E-843D-4A8E-AF95-52524B68A0B7}\.cr\Y0FY4JXWwIkRvJP.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Y0FY4JXWwIkRvJP.exe" -burn.filehandle.attached=548 -burn.filehandle.self=544
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4336
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
385KB

MD5
52c9ccef22e10693f2e36dfa84e92b18

SHA1
8727f435c30c7beb2a786e34b48edc3260be6132

SHA256
1a424ae8a9e8c131dda2b209f57cdd5dcdbfcde8e6c8c76094fec4178d7866f9

SHA512
33659f82cb3a14968db834a0fe9c7b8406c5737c454c29a972fb116d53b9f8d1a98cadafd1c0f257ccc23d1f4939676c84c617c3e906c54116f39e0ea9ebe2c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y0FY4JXWwIkRvJP.exe

Filesize
841KB

MD5
f33aac555c5e5a2c10d07e3bbf9a9e82

SHA1
75fa5322fdc00223246bc70fcb6772ae9f10e97c

SHA256
8977d454b74e2abbafc3be6a3b2e7946d1cde530d742235bc1e5cc229e231aa6

SHA512
a64d465c327cd3799044fa1e8786812e055b72aea7faeac66916c7cf1f762bb919d211060cc7944b84037c316babb796ef449d1049a162d8faa51b08d05cef34

Download Submit
C:\Windows\CTS.exe

Filesize
64KB

MD5
57420c17bd242fb4f64b5dc64e8b7f35

SHA1
a2cc6bbbe06fc5f68c6c2ddc23e2968abdc8c106

SHA256
20ac402e565004441ca1a75ae98137231bdefa16d112d56ed7172b622799a2d8

SHA512
66dacad3da58b99594af019e6cd603bb31162379f603a073f8ec6827e2ce9f3d885dfb6a61bcc4dd9ae0e0da1a218ca0c9b90af3f895964fadc10a6eedf6d97e

Download Submit
C:\Windows\Temp\{92455DF3-BCC3-45AF-9617-A39C38DDA866}\.ba\PythonBA.dll

Filesize
600KB

MD5
910d34f4b8e8c40e2c7ea16335c7a27c

SHA1
d1ded5742bd647c688f2749cce0093b6a71b56f4

SHA256
c143b40448e90687587bb7ecb376e96db469f347c0921863af468181fab972e3

SHA512
be3ad1e5fbb4a3c65051b54c70d94f8e14edbbae69ff5670ce7d615171182da9aaeb2004c97c4c76689ce359e71a595cd5931f3500ef7fba001af8e68715084d

Download Submit
C:\Windows\Temp\{92455DF3-BCC3-45AF-9617-A39C38DDA866}\.ba\SideBar.png

Filesize
56KB

MD5
ca62a92ad5b307faeac640cd5eb460ed

SHA1
5edf8b5fc931648f77a2a131e4c733f1d31b548e

SHA256
f3109977125d4a3a3ffa17462cfc31799589f466a51d226d1d1f87df2f267627

SHA512
f7b3001a957f393298b0ff2aa08b400f8639f2f0487a34ac2a0e8d9519765ac92249185ebe45f907bc9d2f8556fdd39095c52f890330a35edf71ae49df32e27a

Download Submit
memory/1256-0-0x00000000002E0000-0x00000000002F7000-memory.dmp

Filesize
92KB

Download
memory/1256-10-0x00000000002E0000-0x00000000002F7000-memory.dmp

Filesize
92KB

Download
memory/3044-7-0x0000000000FE0000-0x0000000000FF7000-memory.dmp

Filesize
92KB

Download
memory/3044-89-0x0000000000FE0000-0x0000000000FF7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads