Analysis
- max time kernel
145s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
05/04/2024, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
- Target d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe
- Size 4.6MB
- Sample240405-vmncwsab35
- SHA256 f3a5c707e81d2f963697e6bda5af7c27d30647362e267b7475a8523098180585
- MD5 d9ab79381f20127c47ddbf8b05e76386
- SHA1 20f38f16c7f5e1a44f5bca94eb7780eee101d48f
- SHA512 3e1ec6f297689aef1ab4e5e0f2f39f12e1aa917a1051de658e3dc380b228fe5b5d53c2ca2138c2e995f71827f6db37c6834502b18907c82cb3ff8d56c2876f2f
- SSDEEP 49152:L2oZuBy5Tk2mSdbDU72oZuBy5Tk2mSdbDUD2oZuBy5Tk2mSdbDUD2oZuBy5Tk2mj:L6yy77lS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4184 d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.usa - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.17\MicrosoftEdgeUpdateSetup_X86_1.3.185.17.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\firefox.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateBroker.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3808 wrote to memory of 4184 3808 d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe 85 PID 3808 wrote to memory of 4184 3808 d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.usaC:\Users\Admin\AppData\Local\Temp\d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.usa2⤵
- Executes dropped EXE
PID:4184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\d9ab79381f20127c47ddbf8b05e76386_JaffaCakes118.usa
- Size 125KB
- SHA256 948a5b43f1e85f4fae023c7c6cf85236f7818965dd36b5abf88e3c5da864f66d
- MD5 1a1a8c535c4103e03023622faf2df001
- SHA1 bfb41f58ffe0e99260fe6867e20a682911b8ffae
- SHA512 a102f7da7815457722a45153fb37151cc4184633e2da41268f707a756335808cfa59f9122958d697dd2acd46ba35931ebc34a91b0eafc89a52939caacaf534d9
- SSDEEP 3072:WoqId5mtT4XOyVop6PsoB7LTKTeAk3PFU0tv/L:WamR4XOyV5R7LZPS0tn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 4.6MB
- SHA256 549978e845eaab8b9cc2b7a4d2e94a6f47b9a09b6a856d76410aa4f3f9c25128
- MD5 661464dc6e2e71393c0feedf8c9ac7cf
- SHA1 1c10157bd18b97b15099d7f2801371211fc5c704
- SHA512 0e666029a3a5eb96c335a47ac3d22b0a2baa9fd5b3a57c0602791d8674a6337c64a7d025187a50f29303092e28588923419459d3dbeb113e041f7dd2ed930285
- SSDEEP 49152:R2oZuBy5Tk2mSdbDU72oZuBy5Tk2mSdbDUD2oZuBy5Tk2mSdbDUD2oZuBy5Tk2mj:R6yy77lS
- MD5 SHA1 SHA512 SSDEEP