Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 07:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe
-
Size
158KB
-
MD5
df2e1a5648b130f214e61c251d710188
-
SHA1
e3b705fb05cd816d012362798ec5deea57f7a483
-
SHA256
46ca77c13ede88ed1dc4be9b4cc30c743288533e11b54a6e7139123a19ce8f47
-
SHA512
dd380774c8c3dc2219b9109e5886382d5919a1b1dc13b8352d4835ee3d90a1c9e445b3360a9c62ed21d88da60e41945eebbed19e49443ea47cbc98dcaba1ce86
-
SSDEEP
3072:qKtfDwsjPThTYszDH2fHVUcdPuPHfEjETjPNtSweAhPXjSvZmXHlfHYTo:BtfDwsjPThT5zL2dBUPHfAETTNt2Apz0
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 688 Logo1_.exe 4440 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 212 688 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe 688 Logo1_.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 872 wrote to memory of 4804 872 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe 86 PID 872 wrote to memory of 4804 872 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe 86 PID 872 wrote to memory of 4804 872 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe 86 PID 872 wrote to memory of 688 872 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe 87 PID 872 wrote to memory of 688 872 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe 87 PID 872 wrote to memory of 688 872 df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe 87 PID 4804 wrote to memory of 4440 4804 cmd.exe 92 PID 4804 wrote to memory of 4440 4804 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E7.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df2e1a5648b130f214e61c251d710188_JaffaCakes118.exe"3⤵
- Executes dropped EXE
PID:4440
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 6683⤵
- Program crash
PID:212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 688 -ip 6881⤵PID:4744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989KB
MD5684f48bdfd22748ef23c2fbd1628357e
SHA1a3d0e405d103c363f1efbe68c2e3888349002ec2
SHA2565ca2dcde50de230f4cae444db23b18d7182789e66feaf7ea31e78e0df6d4b78f
SHA512778ab693b4e12c1b4ee40294df5c3ae7f04f0e8fab70f4fd5739cd30df71d4137fb93d84673466159c77863f4d54c7b4a66e2bb3a18a42974bebec72f527e311
-
Filesize
614B
MD5ee5e4ba27a073a3b7eff6a57c483590f
SHA1892037808ac6262e1f4180c0f67c9525970e20c4
SHA2566613a926f5805e331f596747cb1ce55c484e8a944c6a0a4507feee468754b8db
SHA512fb63fc82d3d3a5dcddeba6100edc5efb43a3a5202e150f36f056d471bab36e749b8f61be25e0feed0d18beb61659e5cec013c16b56410364c6ad669ec5e2552e
-
Filesize
100KB
MD55cb5adb9d9b10cc96ca71e9dce5e5085
SHA137175531b42ce7dded08b25e9ea1508d1d610cdf
SHA25688284e1badbb2d64c763cfa3cd2c25a3d4985396bed091f042ee00a83cfc23af
SHA512e611f97a279ef274c5282560767bc922d514fc9ea5bace40ff8c517d13dc749a9c73b9fd4b4ee629270d9999a18e9c6f683bb35f5c1ffd484c2fa5e2b8e5aad2
-
Filesize
58KB
MD5c9744814ccdabc3274e7562e65ef2d47
SHA1ac3c9e04ea4049aed591e33e11ebddea97e50d27
SHA2568fece78c786e66ea55e43a96ca72687aec61eb7e83e9b748572c95ea793a9ce8
SHA512f5b5dc9a737a1ef82d029c0d37864725253d1e28aa45231002f2d4054069dcec5e820d9630fafab8a004142eb41ea584487331ef435d14d2bbdfbd42825056ec