Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe
-
Size
90KB
-
MD5
dc82b95bc77bd7adf65a776e2252a799
-
SHA1
45bff1aecaaee83e46b00546c1547f9ec00130db
-
SHA256
ca3a63446d2d40562b1f0ec100d29effb5a004e747c3ac0236f6e8eb9c63a93a
-
SHA512
6c43ac9aa64c4e482fcb181675689366a72c4d06b8165f42d2b558543d63428f9e7d3a6caf91770928e87c6bb7769a03f766507d7428b26d9c02b1ab2f3c34dd
-
SSDEEP
1536:NdF6Y9JIXfLrhoCQISaS86P9cPGK7v4Bv1HQ2YmK:NR2FoCQaS8y9cPz4BvFQH
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\VideoLAN\VLC\uninstall.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\Hearts.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WINWORD.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Java\jre7\bin\javaws.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GRAPH.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SETLANG.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.usa dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Games\Solitaire\Solitaire.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1524 dc82b95bc77bd7adf65a776e2252a799_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bc5cd02ddb97cbcde8f0505c8ec2753b
SHA1580a305ccc2bf18e1e1bb9e3a8542ea6cd2e845a
SHA256a82bd6d2371ddfe74bb4649b9b23dd50d236543079c9e24ba3fef1e9859ec3a6
SHA51289cdc6ee84e355667a104e82b43825a88edfacd13b904ed5a4f92535ddfb6583620ec036181be28a9b4eaadaf48d33787da5fc917a4cd593cfc2fc1906c97d14
-
Filesize
90KB
MD5a6bf392e65fafb41cf9d2730e131bc8d
SHA1533fb00e00d775dfc34613c43134ece06eff22b1
SHA2567df75c216cf38121a016c946eca3e6ab971ff997e6b2dbf546048f6948d2f44c
SHA5123a976d027c725653ddd10df49fe843f1859db31509472b755837acc754ef513ef5eb8c938c9d103e7425edcdf5aef3632020d9fd10f0ed9a0a724cc748ed0446