5403af9977fd94503913667d164e3a751e91e1d07fa67db01dc661219c708eaa

General

Target

5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Size

11KB
MD5

5c493f9fb1c601a4aa76b695d4e00123
SHA1

62ef64de682fcb1f015c1e402888f7f070120732
SHA256

5403af9977fd94503913667d164e3a751e91e1d07fa67db01dc661219c708eaa
SHA512

9fd1a33e3cc7bb7f042840f5167746f260ca0b221f03af540b535b023b0eac01beda886cc336e0d013b62bf213a221567446c7d2390f46a5699e00df2e7d1ea7
SSDEEP

192:9/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMW3YN51:9ebFNw4Pk1itKkpAjjJs6B40WW3YNT

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.XLS	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files\RequestDismount.mp4	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.XLS	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-sonic-symphonyntsc_31bf3856ad364e35_6.1.7600.16385_none_d75d6085d60aa50d\Symphony.psd	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-sonic-symphonypal_31bf3856ad364e35_6.1.7600.16385_none_cd66bc3541f90a26\Symphony.psd	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_1080_5sec_10mbps_h264.mp4	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_480_5sec_6mbps_h264.mp4	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\Symphony.psd	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Styles\PAL\Symphony\Symphony\Symphony.psd	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\Performance\WinSAT\Clip_1080_5sec_10mbps_h264.mp4	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\Performance\WinSAT\Clip_480_5sec_6mbps_h264.mp4	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
File opened for modification	C:\Windows\ShellNew\EXCEL12.XLSX	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell\open\command	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell\open	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.$MTF	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.$MTF\ = "QNZLEINWANSPJYX"	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mI3wNClH6fF8d8m.exe,0"	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mI3wNClH6fF8d8m.exe"	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\ = "CRYPTED!"	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\DefaultIcon	5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\CloseDismount.xlsx

Filesize
12KB

MD5
80a3016379d719942c158d29be7d77f0

SHA1
abd6a51d71369c5d7e3f9498e6b6756805b98cad

SHA256
8e3037d2280aef830792bd3964b9808e663ffe8f653cd3676ad541ff025098e5

SHA512
dde3604fe878f8a631c41165f916fa989ad0f86b72b7a7745eae5a40a9f28f36a8f83c226d5a07d023c58988ba11f93ab060634327b84de91232dd6ba2efc421

Download Submit

Analysis

Sharing