Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe
-
Size
250KB
-
MD5
d5b1f4e23072e2544743dc64ab33c304
-
SHA1
beac8bc4749f468abe100891bef58e77937e6770
-
SHA256
84ae8fb70597b294f97dc4bb4413cfaafbfefb740950e2f6a52d7b8bed897913
-
SHA512
e21aa34168270ffbcc5ff0d14395ef58239b45beddd0010044349d7c6e7d6591af5bee0cd4d6b7f3ad9ada214133ba78dc67fa848533d77bd8f790fbb2e82152
-
SSDEEP
6144:BtfDwsjPThT5zL2780N2vAE+Zmmt0fSoD76GopfGh4U7:B5hVc80N2Ymmt0LDXoNQ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3700 Logo1_.exe 180 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{13D35E3E-D723-4ADE-A208-2AB0A3B02FDA}\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\MicrosoftEdgeUpdateSetup_X86_1.3.185.17.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_124281\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\virDll.dll Logo1_.exe File created C:\Windows\Logo1_.exe d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe 3700 Logo1_.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2172 wrote to memory of 4760 2172 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 86 PID 2172 wrote to memory of 4760 2172 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 86 PID 2172 wrote to memory of 4760 2172 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 86 PID 2172 wrote to memory of 3700 2172 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 87 PID 2172 wrote to memory of 3700 2172 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 87 PID 2172 wrote to memory of 3700 2172 d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe 87 PID 3700 wrote to memory of 3356 3700 Logo1_.exe 57 PID 3700 wrote to memory of 3356 3700 Logo1_.exe 57 PID 4760 wrote to memory of 180 4760 cmd.exe 89 PID 4760 wrote to memory of 180 4760 cmd.exe 89 PID 4760 wrote to memory of 180 4760 cmd.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55F0.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5b1f4e23072e2544743dc64ab33c304_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:180
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3700
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
602KB
MD573038a20a2f3fad5f4269b5ddc6faed6
SHA1e72ea33459d017c5b2bdeec3e288bd726cb54ca4
SHA2566f0e438fa7197f0e12ca7659804395a438f644615789c931b1d3b68c71acde3b
SHA5129fe32aed4b42d99aae0bc5ae9fa1d5c77e0ad8d49cf98ca2dbcee588f3799f11d132c87153844d96d819d5effbbd0a67974b798b4417ab4b0d90f4cddb93be43
-
Filesize
614B
MD5d973e21a09c2570ceeeff16138f9e5ab
SHA128ba98bd8db0fc8d74297ef72794d1f49cff8df1
SHA256cdb6411f3f0740e4b1abb11a429bf65ded498674a25e8b3a9338de7467e7792a
SHA512cb3fb2e2fbb4983b81e5aeda57bd1db3926450c3f8ffbed649ed7e493532b8c4caed4abcf9cf887cf0306c2c1cc6a63fd99c1012b11fe9ddd489603b28035f19
-
Filesize
191KB
MD51650874a0337b8776e5f92791f26c709
SHA1a536423256becc7fa873a5af70ad0ac6f053312d
SHA2562b8f77719ff7528fc7147d381d98f0171390b94b85f84f9b4483e9322f140726
SHA51205e76d7d107e7b8d1c9ee6f68f824a0c04a6658e994aa44f86d08aba38e641bba06dfc3668160d0f55625f784e263fe3010231f0a0c76d637b378622662147db
-
Filesize
58KB
MD5900ef496519cb93a3f999271aaa82b9c
SHA10796f29248d0c314cb35a374df833ac2d3516750
SHA25665f5ab8d24cce61bbee3c3629a2a4c0ffe6e936d2e37c2a6290f9eaa484fe6d9
SHA5129054049dd534c712d37634e5c0eca3474fd3acf6592ea8fb92403436cd18078fab2f0fedb6bdcbf82b95c586868fddfc6c0b9dba251caa129d6c0ba8958acace