aa8e1238c90b64de744f43f9b467d13b17841b28181658e48e672ccf849a9612

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
Size

236KB
MD5

cd9061b3266296b21118c0ae6b5db1df
SHA1

e4a0b0ff066f038a0f3b17b8785e16c29cd28814
SHA256

aa8e1238c90b64de744f43f9b467d13b17841b28181658e48e672ccf849a9612
SHA512

402d1a6f9434e8cbf0c8984492784438a00ce5979a62a1d76fb47347774bee4cd3000ff5bc9ef42cef0ef53f4d4301024fac1ad07f3ff1e25d9fdf093c626073
SSDEEP

3072:NR2FoCk4wHbSwnIqR2FoC44wHbSwnYqRT:NSrwHWwnIqSHwHWwnYqR

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\ssvagent.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre7\bin\javacpl.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre7\bin\javaw.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre7\bin\javaws.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\GRAPH.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\FreeCell\FreeCell.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\VideoLAN\VLC\vlc.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Games\Chess\Chess.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Mozilla Firefox\private_browsing.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\7-Zip\Uninstall.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre7\bin\ssvagent.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files\7-Zip\7zFM.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Chess\Chess.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\misc.usa	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2764	cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cd9061b3266296b21118c0ae6b5db1df_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
507KB

MD5
b15c13231ba54ce6e9b096d1f1bf7c58

SHA1
8f03b783aade8e8349d8de7ceee55353e9a018cf

SHA256
4edad7b5ae93f98702f46af2aae930c5de97fd8b666708f7f3437e4f09cc41db

SHA512
91decdd9857e9bcb5dfd029671978115861596e7accc0a9b3062f92e9492fbab612cb8534494701648b6de388589c0c3dd228c1cf84b60f0eeeea8660486274c

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
930KB

MD5
cb3558823781abfb729229ba0843ed2f

SHA1
c991ed42250babe54759588126fc882b0dd8f72e

SHA256
7d98c66bfef0c04954b7b8dbca2326f899741ad8190b17bbb15540140657ef0e

SHA512
f368070ec03d66ded8cf7de416d1e79759af43441c0fa47a5acc99c8198bdd219ac62c213e32964f1df7ffc4a158c3433a0d8403b769eccacc8a93ca692ec3fa

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
fef0c9622369630de37d6cff9c935f7f

SHA1
4eb657fc815b7f58d5b263ee6e7744b86eeea4f8

SHA256
b0b660dc160fb8dc84a291da6236d3c6edc3b95f270a519ca967b6ac57011d0e

SHA512
a3e200158a2f7f67451f2ec7e58f2d57c4887e0f9a4fd39cd3a1f70ca77d44129ec89a57b3df78e8b89e4822c301225b74757c3a7ce798e2849eb5a117802bc8

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

Filesize
118KB

MD5
c3c06d80d431f77675cfd1f976a0d128

SHA1
9edde516a5b6dd8863576f784afaf0096b51e056

SHA256
87e49fb141fe9721afe0fe0a2e04fbcf09b610581f43d89722deb6d6705252c2

SHA512
45b77a68bc21f9bb7c314ec62d5dd8ef9ea6f01fed230849b56af3eb3d81cbcd607de7f0e40ce0ade3c41e3149eca1f26661b575981444bdcfd44ebf8d036bec

Download Submit
C:\Windows\SysWOW64\UsaShohdi.asu

Filesize
236KB

MD5
cd9061b3266296b21118c0ae6b5db1df

SHA1
e4a0b0ff066f038a0f3b17b8785e16c29cd28814

SHA256
aa8e1238c90b64de744f43f9b467d13b17841b28181658e48e672ccf849a9612

SHA512
402d1a6f9434e8cbf0c8984492784438a00ce5979a62a1d76fb47347774bee4cd3000ff5bc9ef42cef0ef53f4d4301024fac1ad07f3ff1e25d9fdf093c626073

Download Submit