d9aaf683f718686b3770bc597784aeee0d7dc81a418df3e6404f2ee5b6bb006b

General

Target

9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
Size

136KB
MD5

9f0af9631cf52ffee2c6d6a424866883
SHA1

4cc6c30373c06517544cb8147d0f070d28b0594e
SHA256

d9aaf683f718686b3770bc597784aeee0d7dc81a418df3e6404f2ee5b6bb006b
SHA512

a9a348665d4a61e099b45790612b6d461030a837f449ed537d1e43919454cfcdf69349abbc49bf2960e4500770aaf2cf4b49871058af1128e3e65944e681eb5b
SSDEEP

3072:fP7kEDyliVWhD0nVLxfufrUgEywaD9PTYOEZ6prEsgOl:fzkEDyliV1yEDgTY16prWO

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe"	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2644-2-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2796-8-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2796-6-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-11-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-61-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2572-63-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2572-64-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-151-0x0000000000400000-0x000000000045E000-memory.dmp	upx
behavioral1/memory/2644-152-0x0000000000400000-0x000000000045E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe

description	pid	process	target process
PID 2644 wrote to memory of 2796	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2796	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2796	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2796	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2572	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2572	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2572	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
PID 2644 wrote to memory of 2572	2644	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe	9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\5FC2.F4B

Filesize
1KB

MD5
400e4b2f9b81f85e8af2b98723b985e5

SHA1
8fa642ef00c3e867565371f2145cc53b9a27f7ad

SHA256
34136dba36e6024a59d9fb78b19da91d85d182913b246570efad22dee4c5dae6

SHA512
bde5658fdb45150b24b6092292ba149dbbca4aa91621e5bb6cc620d6e599abf4daf12b339f4428b6b5f418ab2bac99dfd54bce80e4f5cb7c7810c08cb034d618

Download Submit
C:\Users\Admin\AppData\Roaming\5FC2.F4B

Filesize
300B

MD5
1321f91177af81eed54201936dbc6c96

SHA1
f80be5aebf767622903f7755420e546915c4e0ff

SHA256
96ea7da3b2e08ec122d2ed49e2a6914e0d2d97da6a83dcd0cb6636b2290f2662

SHA512
3d4fac1d98bd4c9e843276c6aab9ceee13f353eb39edeff47d840b7be9efcd7622b3a36192b7057c7183cf96b8dbf75acaacc5a8ff4d46eeed77704169bd618b

Download Submit
C:\Users\Admin\AppData\Roaming\5FC2.F4B

Filesize
696B

MD5
31f3086087ae43f7fcbc44ae6eee66e8

SHA1
10bb669410cddc850159f1559288b19fd634973d

SHA256
9906104ed80a09904ed97c56140917bc5f0dc8658704ebc4221117f6ab63b57e

SHA512
b0a22d0214f857abf8209718489c5b6b26536bdab2a0e7d7c9e392f82d6ea84e0578b247330b16b54547c6d8ed1dbfb3a1a8a099a4fb6d22582247e247ab4142

Download Submit
memory/2572-64-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2572-63-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-11-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-61-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-2-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-151-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2644-152-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2796-6-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2796-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2796-5-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads