Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe
-
Size
76KB
-
MD5
dc3b465454af3811a5b1a6323e03c96f
-
SHA1
37b52ed6f54638dccf3b25cf111d248107aff408
-
SHA256
68d0913a23e38aee84a3b9176595b8fc6f85bfd7497a95a1d23b9ba9c70cad94
-
SHA512
e3e7383f0e5f509f354d7e4d5ae1d89c7337b72dcb4fc5e5058b454c576757f30daf80f383cfcf0c44136bf21782c78702dc868bbfac222a0256453dd8ac5a2a
-
SSDEEP
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitl8PW6/4:qKtfDwsjPThTYszDH2fDyB/4
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1976 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 3012 Logo1_.exe 2408 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 1976 cmd.exe 1976 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe Logo1_.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpenc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\virDll.dll Logo1_.exe File created C:\Windows\Logo1_.exe dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3012 Logo1_.exe 3012 Logo1_.exe 3012 Logo1_.exe 3012 Logo1_.exe 3012 Logo1_.exe 3012 Logo1_.exe 3012 Logo1_.exe 3012 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2792 wrote to memory of 1976 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 28 PID 2792 wrote to memory of 1976 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 28 PID 2792 wrote to memory of 1976 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 28 PID 2792 wrote to memory of 1976 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 28 PID 2792 wrote to memory of 3012 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 29 PID 2792 wrote to memory of 3012 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 29 PID 2792 wrote to memory of 3012 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 29 PID 2792 wrote to memory of 3012 2792 dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe 29 PID 1976 wrote to memory of 2408 1976 cmd.exe 31 PID 1976 wrote to memory of 2408 1976 cmd.exe 31 PID 1976 wrote to memory of 2408 1976 cmd.exe 31 PID 1976 wrote to memory of 2408 1976 cmd.exe 31 PID 3012 wrote to memory of 1196 3012 Logo1_.exe 21 PID 3012 wrote to memory of 1196 3012 Logo1_.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a25B9.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc3b465454af3811a5b1a6323e03c96f_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:2408
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
614B
MD52b6cc3eaa5eed75e67b8b36cd3652a5e
SHA12495fff8fc9321f42426844d48de0348d58f0f08
SHA2560c7e29512b82a0a1b6955d31a2170b5bf0bf69b6f24b71291815ceb97a79082c
SHA512fda6de2dabb4a0a725609913aea489968a840bc2b8395416abab42fb03612b433ceeaa6c73fa0bf46cec5a6530cd09a11133928d3d8a163d8d73715dca712e61
-
Filesize
18KB
MD577727b915db20a529be45b065bcd1e06
SHA1ed010c2b80fd73413ae996d379004c4d996325b9
SHA256d41f7aad49c106e1a8bc19ecc5eb938679ddcc7f7df082714d8f95eb0f2a2387
SHA512845f1506474f3b604d3f6eaf955da5840741e64f281e16033b599029c375360770b32c6071582450a329724ad731388a797e5cd81d742dfd3004f5ee9918a80f
-
Filesize
58KB
MD595171e6dfb058af81fa91c507acef887
SHA1251de8a3bad783a43e48e44c6d45b28253ff9bfb
SHA2560986d881f40f22dd7897b8f7a8a8a836d6867952a665460e6c240bda4c69cb8e
SHA512e8fa72fd4f54527da630847f3944321180fa1759e1f432c08dc047486768373f7ebb8b526afdd9307809d706b1c2b1dc635ebe74ab8afc769159de2b7d63c19c