Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 05:11
Static task
static1
Behavioral task
behavioral1
Sample
dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe
-
Size
72KB
-
MD5
dc13d24e056c80813c44d68d54af8cfd
-
SHA1
a9f34ebe418d9efcb517f077cc2f965e2d6c9a34
-
SHA256
7b014711b716b2b4258214c6a4e2a2643d29403371dbcd717bd042d391299d7d
-
SHA512
3da4f732958683ccd96f24545e2c18ef72e6db3e36c1e8e8289c72cada165a7fab93cabf5989730478725a95f42f99a146299dbaeb488a441e4cc5ee6b89a30e
-
SSDEEP
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitiF4GQadCh:qKtfDwsjPThTYszDH2fDGhu
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2508 Logo1_.exe 1432 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{90C18CAD-5F48-47B1-8376-0F604ACAA84C}\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe 2508 Logo1_.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 624 wrote to memory of 2360 624 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe 86 PID 624 wrote to memory of 2360 624 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe 86 PID 624 wrote to memory of 2360 624 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe 86 PID 624 wrote to memory of 2508 624 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe 87 PID 624 wrote to memory of 2508 624 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe 87 PID 624 wrote to memory of 2508 624 dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe 87 PID 2508 wrote to memory of 3452 2508 Logo1_.exe 56 PID 2508 wrote to memory of 3452 2508 Logo1_.exe 56 PID 2360 wrote to memory of 1432 2360 cmd.exe 90 PID 2360 wrote to memory of 1432 2360 cmd.exe 90 PID 2360 wrote to memory of 1432 2360 cmd.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FF5.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc13d24e056c80813c44d68d54af8cfd_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:1432
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989KB
MD56f1d1fa4eebaf55531b107d0cede0945
SHA1f659488b079270563a08968ebcbcb6d4ba9abec8
SHA2564328b24e4273afefe2c1e11ab1c8d1080e1f36bac1ad506cc6f486c15ee65fc4
SHA512e45e78e47699aa14f0b83c234b0a8095232f48be713f82c81ca07a014b9c5fc180db6ebcd7e48716a3852c6c9dc19d03d84f90a339f20427fd6114330d13c012
-
Filesize
614B
MD5decbfff3afc5024361240f9397ea1379
SHA100f5f841de2ecedfde30ea01bd1ca0ebb0074771
SHA256caf195d9e5ff28e52d9a9e41417c2c483e13c1eed2b9dfe792b33dbb26c50235
SHA512cd9775fb8c4d4b8361e2a84460719d5d827e32f15677904ac604badca731e248588194ae74f40821f96864a232d79fc3fd338d624597292e3e036101128ff574
-
Filesize
14KB
MD5bde3ac1c9b09fc1b55c6e398009a9c83
SHA1fa99711be9d0812383d1f41e9277bd3ba71eb09f
SHA256059263f4b3635da33f1bae9789b13f287bce7b8dedc960201e8807e6de9b3fc5
SHA512af2ff4728885c6319800f98f4f639f836eb4713272d3dbf38c5f473b91b398747ce6bdc56d32cd0fc2ddc88f3ba1b99e170e6f679341d4c3e5a9eafaf3930e99
-
Filesize
58KB
MD5a7dcffd56f068633bfaf85ec3d65d08b
SHA136cba2a5522ebd673107d63f9d8e1afbdfa236b6
SHA256409f7415b7b10f6d801014ac6b0e3cea785ad5a73ba397f46765bbd3dcf36367
SHA51278dc44535430d92307bfbd5b679159f7032306f3f818b0d5a3264347c227bd8edd0ae07bd9f6beaf91c33ee81a451d01177d08c254ace779dfd66ab9666bf6d1