Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 16:40
Static task
static1
Behavioral task
behavioral1
Sample
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe
-
Size
677KB
-
MD5
e5616e35325978498fbbda48538ab23f
-
SHA1
7e4ba48c00eddaf2eb2804f0a9fb033954a83f60
-
SHA256
e4a8662d439ee680d42971b9a2d85fc05c3f3332a63aae59d86939845f59fcb4
-
SHA512
ec494363b29b530c220a47586f4d798647487056cd69fe10d02589ddaca998bb351f6c2489ff6ea50e03a12982f0b03f5a0949d2b5247d29ac87f8de78b6d1be
-
SSDEEP
12288:x7TbvGeNiKXPwIWIo75lLhJ0S76kJUKZvHoWkrA3TouZUZSCQE:xq+XPg7/V6c5dIJuT
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 320 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
rar.exerar.exelsess.exepid Process 2696 rar.exe 2484 rar.exe 3036 lsess.exe -
Loads dropped DLL 13 IoCs
Processes:
cmd.exeWerFault.exepid Process 2552 cmd.exe 2552 cmd.exe 2552 cmd.exe 2552 cmd.exe 2552 cmd.exe 2552 cmd.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
regedit.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\windows\Entry1 = "c:\\windows\\web\\printers\\123.bat" regedit.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.exedescription ioc Process File opened (read-only) \??\e: cmd.exe File opened (read-only) \??\g: cmd.exe File opened (read-only) \??\h: cmd.exe -
Drops file in Windows directory 47 IoCs
Processes:
rar.execmd.exee5616e35325978498fbbda48538ab23f_JaffaCakes118.exerar.exeattrib.exedescription ioc Process File created \??\c:\windows\web\printers\124.bat rar.exe File created \??\c:\windows\web\printers\jinshan.vbs rar.exe File opened for modification \??\c:\windows\ztop\svchost.exe cmd.exe File opened for modification \??\c:\windows\dell\lsess.exe cmd.exe File created \??\c:\windows\web\printers\125.bat e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File created \??\c:\windows\web\printers\1.reg rar.exe File opened for modification \??\c:\windows\web\printers\5.reg rar.exe File created \??\c:\windows\web\printers\bb.vbs rar.exe File created \??\c:\windows\web\printers\jin.vbs rar.exe File opened for modification \??\c:\windows\web\printers\svc.bat rar.exe File opened for modification \??\c:\windows\intell\1.txt e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File created \??\c:\windows\web\printers\svc.bat rar.exe File created \??\c:\windows\web\printers\md5.txt cmd.exe File created \??\c:\windows\web\printers\360s.txt rar.exe File opened for modification \??\c:\windows\web\printers\gl.txt rar.exe File opened for modification \??\c:\windows\web\printers\jinshan.vbs rar.exe File created \??\c:\windows\web\printers\SVCH0ST.ini rar.exe File opened for modification \??\c:\windows\web\printers\124.bat rar.exe File created \??\c:\windows\web\printers\abc.vbs rar.exe File created \??\c:\windows\web\printers\SVCH0ST.EXE rar.exe File created \??\c:\windows\web\printers\3.reg rar.exe File created \??\c:\windows\web\printers\4.reg rar.exe File created \??\c:\windows\web\printers\123.bat rar.exe File opened for modification \??\c:\windows\web\printers\360s.txt rar.exe File opened for modification \??\c:\windows\web\printers\bb.vbs rar.exe File opened for modification \??\c:\windows\web\printers\usbhard.rar e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File opened for modification \??\c:\windows\web\printers\rar.exe e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File opened for modification \??\c:\windows\web\printers\1.reg rar.exe File created \??\c:\windows\web\printers\k.bat rar.exe File opened for modification \??\c:\windows\web\printers\k.bat rar.exe File opened for modification \??\c:\windows\dell\lsess.txt rar.exe File opened for modification \??\c:\windows\web\printers\QQlog.exe rar.exe File opened for modification \??\c:\windows\web\printers\SVCH0ST.ini rar.exe File opened for modification C:\windows\web\printers attrib.exe File created \??\c:\windows\ztop\svchost.exe cmd.exe File created \??\c:\windows\dell\lsess.txt rar.exe File opened for modification \??\c:\windows\web\printers\zzz.rar e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File created \??\c:\windows\web\printers\5.reg rar.exe File opened for modification \??\c:\windows\web\printers\jin.vbs rar.exe File created \??\c:\windows\dell\lsess.exe cmd.exe File opened for modification \??\c:\windows\web\printers\abc.vbs rar.exe File created \??\c:\windows\web\printers\gl.txt rar.exe File created \??\c:\windows\web\printers\QQlog.exe rar.exe File opened for modification \??\c:\windows\web\printers\SVCH0ST.EXE rar.exe File opened for modification \??\c:\windows\web\printers\3.reg rar.exe File opened for modification \??\c:\windows\web\printers\4.reg rar.exe File opened for modification \??\c:\windows\web\printers\123.bat rar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process 2328 3036 WerFault.exe -
Runs .reg file with regedit 3 IoCs
Processes:
regedit.exeregedit.exeregedit.exepid Process 2440 regedit.exe 2404 regedit.exe 1924 regedit.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exepid Process 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e5616e35325978498fbbda48538ab23f_JaffaCakes118.execmd.execmd.exelsess.exedescription pid Process procid_target PID 1072 wrote to memory of 2552 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 29 PID 1072 wrote to memory of 2552 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 29 PID 1072 wrote to memory of 2552 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 29 PID 1072 wrote to memory of 2552 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 29 PID 2552 wrote to memory of 2696 2552 cmd.exe 31 PID 2552 wrote to memory of 2696 2552 cmd.exe 31 PID 2552 wrote to memory of 2696 2552 cmd.exe 31 PID 2552 wrote to memory of 2696 2552 cmd.exe 31 PID 2552 wrote to memory of 2556 2552 cmd.exe 32 PID 2552 wrote to memory of 2556 2552 cmd.exe 32 PID 2552 wrote to memory of 2556 2552 cmd.exe 32 PID 2552 wrote to memory of 2556 2552 cmd.exe 32 PID 2552 wrote to memory of 2440 2552 cmd.exe 33 PID 2552 wrote to memory of 2440 2552 cmd.exe 33 PID 2552 wrote to memory of 2440 2552 cmd.exe 33 PID 2552 wrote to memory of 2440 2552 cmd.exe 33 PID 2552 wrote to memory of 2484 2552 cmd.exe 34 PID 2552 wrote to memory of 2484 2552 cmd.exe 34 PID 2552 wrote to memory of 2484 2552 cmd.exe 34 PID 2552 wrote to memory of 2484 2552 cmd.exe 34 PID 2552 wrote to memory of 3036 2552 cmd.exe 35 PID 2552 wrote to memory of 3036 2552 cmd.exe 35 PID 2552 wrote to memory of 3036 2552 cmd.exe 35 PID 2552 wrote to memory of 3036 2552 cmd.exe 35 PID 2552 wrote to memory of 1924 2552 cmd.exe 36 PID 2552 wrote to memory of 1924 2552 cmd.exe 36 PID 2552 wrote to memory of 1924 2552 cmd.exe 36 PID 2552 wrote to memory of 1924 2552 cmd.exe 36 PID 2552 wrote to memory of 2404 2552 cmd.exe 37 PID 2552 wrote to memory of 2404 2552 cmd.exe 37 PID 2552 wrote to memory of 2404 2552 cmd.exe 37 PID 2552 wrote to memory of 2404 2552 cmd.exe 37 PID 1072 wrote to memory of 320 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 38 PID 1072 wrote to memory of 320 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 38 PID 1072 wrote to memory of 320 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 38 PID 1072 wrote to memory of 320 1072 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 38 PID 320 wrote to memory of 1744 320 cmd.exe 40 PID 320 wrote to memory of 1744 320 cmd.exe 40 PID 320 wrote to memory of 1744 320 cmd.exe 40 PID 320 wrote to memory of 1744 320 cmd.exe 40 PID 3036 wrote to memory of 2328 3036 lsess.exe 41 PID 3036 wrote to memory of 2328 3036 lsess.exe 41 PID 3036 wrote to memory of 2328 3036 lsess.exe 41 PID 3036 wrote to memory of 2328 3036 lsess.exe 41 PID 320 wrote to memory of 2628 320 cmd.exe 42 PID 320 wrote to memory of 2628 320 cmd.exe 42 PID 320 wrote to memory of 2628 320 cmd.exe 42 PID 320 wrote to memory of 2628 320 cmd.exe 42 PID 2552 wrote to memory of 1272 2552 cmd.exe 43 PID 2552 wrote to memory of 1272 2552 cmd.exe 43 PID 2552 wrote to memory of 1272 2552 cmd.exe 43 PID 2552 wrote to memory of 1272 2552 cmd.exe 43 PID 2552 wrote to memory of 1444 2552 cmd.exe 44 PID 2552 wrote to memory of 1444 2552 cmd.exe 44 PID 2552 wrote to memory of 1444 2552 cmd.exe 44 PID 2552 wrote to memory of 1444 2552 cmd.exe 44 PID 2552 wrote to memory of 1480 2552 cmd.exe 45 PID 2552 wrote to memory of 1480 2552 cmd.exe 45 PID 2552 wrote to memory of 1480 2552 cmd.exe 45 PID 2552 wrote to memory of 1480 2552 cmd.exe 45 PID 2552 wrote to memory of 1236 2552 cmd.exe 46 PID 2552 wrote to memory of 1236 2552 cmd.exe 46 PID 2552 wrote to memory of 1236 2552 cmd.exe 46 PID 2552 wrote to memory of 1236 2552 cmd.exe 46 -
Views/modifies file attributes 1 TTPs 12 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid Process 1480 attrib.exe 2628 attrib.exe 1236 attrib.exe 2936 attrib.exe 2808 attrib.exe 2816 attrib.exe 2904 attrib.exe 848 attrib.exe 2556 attrib.exe 1272 attrib.exe 1444 attrib.exe 1776 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.execmd /c c:\windows\web\printers\125.bat2⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\windows\web\printers\rar.exe"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\usbhard.rar c:\windows\web\printers\3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2696
-
-
C:\Windows\SysWOW64\attrib.exeattrib +R +A +S +H c:\windows\web\printers3⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2556
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\windows\web\printers\1.reg3⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:2440
-
-
\??\c:\windows\web\printers\rar.exe"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\zzz.rar c:\windows\dell\3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2484
-
-
\??\c:\windows\dell\lsess.exec:\windows\dell\lsess.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1844⤵
- Loads dropped DLL
- Program crash
PID:2328
-
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\windows\web\printers\5.reg3⤵
- Runs .reg file with regedit
PID:1924
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\windows\web\printers\2.reg3⤵
- Runs .reg file with regedit
PID:2404
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R d:\~13⤵
- Views/modifies file attributes
PID:1272
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R d:\setprter3⤵
- Views/modifies file attributes
PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R e:\~13⤵
- Views/modifies file attributes
PID:1480
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R e:\setprter3⤵
- Views/modifies file attributes
PID:1236
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R f:\~13⤵
- Views/modifies file attributes
PID:848
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R f:\setprter3⤵
- Views/modifies file attributes
PID:1776
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R g:\~13⤵
- Views/modifies file attributes
PID:2936
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R g:\setprter3⤵
- Views/modifies file attributes
PID:2904
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R h:\~13⤵
- Views/modifies file attributes
PID:2816
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R h:\setprter3⤵
- Views/modifies file attributes
PID:2808
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\11a.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib -S -H c:\ma.exe3⤵
- Views/modifies file attributes
PID:2628
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD51a9684b0cdbceae5e4434fbd91397b17
SHA1fe71fb9dea1398da3b6563dad519e32672eed153
SHA256d36c606fa22faeb752cec3528690c6bab9fd536b1a441520597251886c60cc9f
SHA5127f7255e1825ed44fc579b660d35d0afcff4ec01910d59dcdb3636421afb28080d54cb11d39ac1c7374462e96beff69df973a835cbb589342c1eaea398376eab8
-
Filesize
310KB
MD50a5680183c0089a64621e211917664d8
SHA18525d73c99e28413e97a094c99950e1806786246
SHA256c7d6bfe9d26d1ecdd9f2e7f3f892a4d32030949937f86938edcb1995655c2814
SHA512b843b8994c764c3761bef8d34eefb312c9d9567b3f4aadc38008caf42d0cdb82c33276203e4210adcc1e8c567268ebdf01a0a1e839694811932889ac971bb051
-
Filesize
45KB
MD54ad724ba8346d8556e6e884727c0523e
SHA1b53e2ec83b5b8441667b980fe6a53d69987fca89
SHA25648c52c0934097cdd0aea155be18a2006f2dd6884d623a51b00baf3e5de3e1412
SHA512fde2fb90a19fa00d040ade516fef8ca5f4463aee1a8af2fc85f41c3e818365086ff12491c330c8598bf071270bdbd863bbcdb5a5dde3d2523fbd1f6182eb33f3
-
Filesize
22KB
MD53619b2192d1e0d4907f7d4702b4aa9e1
SHA11bb317bea13bb457d9ec71294e5c07c93cc9b8e6
SHA2567da095327a1e11369d67d4f15d7c2e84cce9fb5d4cbac42d9b70bf0976300893
SHA5128f2d8420dc2e92a4df42eab89bb612b2562ff6d152c4a6f651c64371089506673bf9f02a37ff1c3ad53a9ae0fe51aa9c47dcdb7e01a319df51306d58a601b7ff
-
Filesize
46.0MB
MD5e3c1cea3611ee18e5a552572aca79afa
SHA1ab192e6c373481e42be63c60f61635fbf73e6c87
SHA25657d04fde12b8682361f61a731fc413fd1a6e8e30434fb89d4b4755d7783d2462
SHA51250a9104168b76c9bd79f08f672f9156226ef33e1ba2ece677b06ba544159623f10032b7bae332505598daee5dad17a2bbfb7b1099d7f46ef38f7f0d655433778
-
Filesize
1KB
MD51af018ff177dfbae562ac429cff786cb
SHA181f09865306d8c91d59bbec8a11ac874816f102c
SHA256dda4aa27c7fd4b793bcadbd94c47dc997d66e293f910af3826de893b0381914a
SHA512a76fba548576d2c99dac7e040bb140e29a68f55ee024174018345c4236e2a7ebda96d5ed1b66da85ae60d20485847e3cd38d34262be6c45475938f8d2182ab22
-
Filesize
33.7MB
MD5d3c91ba79104275b8fc182c6e32a7cff
SHA1094069eacd5d0fb117a40e310beb2b4aa4590420
SHA256ceae80f544d3ec3ab1211773c601f1ca6eb8319a9e62960bb1fe98ddfbfe0553
SHA51299cc0918b6029b35dd3a7fbcf8dd50b34c05364e7c4045c5dab7b206f510a95ac428a2fd59137ae1b0279d016f6d6bf0440ae8e5a063b1c32594c070b91a1241
-
Filesize
236KB
MD5a0f784ad499c07a7b7c3a48fab5afd0b
SHA18194f876410f89d3e4cc9ad1f86c89d1138b0d6c
SHA25689c23b96ac3837d3ee68ff0684f57e14cee8fc3ac3171d65c173ba6417411335
SHA512a13b015ec263073ddd2aa5ad116f65f7ae38dc592d6fba9ab2fc3dc034c483d53077c83005b9214cecbf8201a5cd50baea33824136903c0604c5cf6ade2f39de
-
Filesize
266KB
MD543f37b9978d9e49e49a0631ac0e6ce73
SHA11ee18c506fa9f66fbe0032aaf5474b3d402f2d81
SHA256433126adae9cd4c985ce970704d4f581fb1c0a3531279c28a89c4f4a7559af3b
SHA512ac93f47dd5281e3c8345a0062d02bdf55d7b70f49a21729d7f2cafa03cf2909261d6ab4ce2d2eebc2c971964fdccce5736702fc1aab640b76708d5baac1a8477
-
Filesize
46.0MB
MD5b9497541781192767fe5bfc45e7a5604
SHA11fb3debd4ba3c0faa922df952eb301ee9efd5b9d
SHA256408bda25d97117db8319fd51f2c3e94548413ffc2f54b2f944ea056f8eb1930a
SHA51255ce8ba2d4831cd75cba24e116916669beaa1587540747bfa08fd579392c1a1a3d1733ab32b5383c098f0e7654c79a29a3cbba6148aeb608f07ae066a442a9fc