Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe
-
Size
250KB
-
MD5
d5b1f4e23072e2544743dc64ab33c304
-
SHA1
beac8bc4749f468abe100891bef58e77937e6770
-
SHA256
84ae8fb70597b294f97dc4bb4413cfaafbfefb740950e2f6a52d7b8bed897913
-
SHA512
e21aa34168270ffbcc5ff0d14395ef58239b45beddd0010044349d7c6e7d6591af5bee0cd4d6b7f3ad9ada214133ba78dc67fa848533d77bd8f790fbb2e82152
-
SSDEEP
6144:BtfDwsjPThT5zL2780N2vAE+Zmmt0fSoD76GopfGh4U7:B5hVc80N2Ymmt0LDXoNQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1944 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2000 Logo1_.exe 2676 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1944 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files\GroupRestart.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2000 Logo1_.exe 2000 Logo1_.exe 2000 Logo1_.exe 2000 Logo1_.exe 2000 Logo1_.exe 2000 Logo1_.exe 2000 Logo1_.exe 2000 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1944 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 28 PID 1304 wrote to memory of 1944 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 28 PID 1304 wrote to memory of 1944 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 28 PID 1304 wrote to memory of 1944 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 28 PID 1304 wrote to memory of 2000 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 29 PID 1304 wrote to memory of 2000 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 29 PID 1304 wrote to memory of 2000 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 29 PID 1304 wrote to memory of 2000 1304 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 29 PID 2000 wrote to memory of 1208 2000 Logo1_.exe 21 PID 2000 wrote to memory of 1208 2000 Logo1_.exe 21 PID 1944 wrote to memory of 2676 1944 cmd.exe 31 PID 1944 wrote to memory of 2676 1944 cmd.exe 31 PID 1944 wrote to memory of 2676 1944 cmd.exe 31 PID 1944 wrote to memory of 2676 1944 cmd.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a11AD.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:2676
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
614B
MD5efb7e21942444a5493791a96223d95a8
SHA1c1688f7da48b884ac344f65f7611c216b7683fed
SHA256b34ae46119e46693c43812541191b67d599162a16f8029e8bd083312e2778917
SHA512bccb31ef43881f4d3f6a9b728a33e472875dcab5aa93cfaa946a08029ec303dea11b4b4dee48a50fd6753d95b0a0e1f7fa56c19995b88fbc5f10153e56a30d1b
-
Filesize
191KB
MD51650874a0337b8776e5f92791f26c709
SHA1a536423256becc7fa873a5af70ad0ac6f053312d
SHA2562b8f77719ff7528fc7147d381d98f0171390b94b85f84f9b4483e9322f140726
SHA51205e76d7d107e7b8d1c9ee6f68f824a0c04a6658e994aa44f86d08aba38e641bba06dfc3668160d0f55625f784e263fe3010231f0a0c76d637b378622662147db
-
Filesize
58KB
MD5900ef496519cb93a3f999271aaa82b9c
SHA10796f29248d0c314cb35a374df833ac2d3516750
SHA25665f5ab8d24cce61bbee3c3629a2a4c0ffe6e936d2e37c2a6290f9eaa484fe6d9
SHA5129054049dd534c712d37634e5c0eca3474fd3acf6592ea8fb92403436cd18078fab2f0fedb6bdcbf82b95c586868fddfc6c0b9dba251caa129d6c0ba8958acace