Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 08:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce317d38ba247091d10346da60177c71_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
ce317d38ba247091d10346da60177c71_JaffaCakes118.exe
-
Size
3.3MB
-
MD5
ce317d38ba247091d10346da60177c71
-
SHA1
05cf0dfd068f987ee69bf6b535a734647b6b865d
-
SHA256
1a4c51b86f2d5a1537986382255170cbdfca2f7a28546a17f090f80cef5076d7
-
SHA512
956f23032a9dac5f8adb6cea90048f09b98574f9171d3b169cdb489acc56c0b965bb62e2fb01c80a3e45a1611fc83a736f68cb9210b69a839293b86307badc80
-
SSDEEP
49152:qwaIxkm0TfwaIxkm0T3waIxkm0T3waIxkm0T3waIxkm0TY:JHXXXF
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2104 ce317d38ba247091d10346da60177c71_JaffaCakes118.usa 1256 Process not Found -
Loads dropped DLL 1 IoCs
pid Process 2372 ce317d38ba247091d10346da60177c71_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu ce317d38ba247091d10346da60177c71_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Games\Chess\Chess.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\Mahjong.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\Hearts.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\firefox.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WINWORD.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Java\jre7\bin\javaw.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\PPTICO.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\7-Zip\7zG.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\vlc.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.usa ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE ce317d38ba247091d10346da60177c71_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2104 2372 ce317d38ba247091d10346da60177c71_JaffaCakes118.exe 28 PID 2372 wrote to memory of 2104 2372 ce317d38ba247091d10346da60177c71_JaffaCakes118.exe 28 PID 2372 wrote to memory of 2104 2372 ce317d38ba247091d10346da60177c71_JaffaCakes118.exe 28 PID 2372 wrote to memory of 2104 2372 ce317d38ba247091d10346da60177c71_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce317d38ba247091d10346da60177c71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce317d38ba247091d10346da60177c71_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\ce317d38ba247091d10346da60177c71_JaffaCakes118.usaC:\Users\Admin\AppData\Local\Temp\ce317d38ba247091d10346da60177c71_JaffaCakes118.usa2⤵
- Executes dropped EXE
PID:2104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5ce317d38ba247091d10346da60177c71
SHA105cf0dfd068f987ee69bf6b535a734647b6b865d
SHA2561a4c51b86f2d5a1537986382255170cbdfca2f7a28546a17f090f80cef5076d7
SHA512956f23032a9dac5f8adb6cea90048f09b98574f9171d3b169cdb489acc56c0b965bb62e2fb01c80a3e45a1611fc83a736f68cb9210b69a839293b86307badc80
-
Filesize
83KB
MD5fd9dfa6958a6dbc6cbd249b1cb79ca03
SHA1f6c3eb801512814d745d5b4678f03cc542118850
SHA256fc25d24b2f847b6403e5f9793562050dd8d8cd2d1726544a18ce14b387a4a3da
SHA512e1e679fee0e7f85eebc6917a4220b80b3b2b4f6d2ce0f5c2e6f017e1075723555f5e5c467cb800576ddef0e33ca4e73aadab64add09e0eacb9d97fb54a9a87b8