Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 16:40
Static task
static1
Behavioral task
behavioral1
Sample
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe
-
Size
677KB
-
MD5
e5616e35325978498fbbda48538ab23f
-
SHA1
7e4ba48c00eddaf2eb2804f0a9fb033954a83f60
-
SHA256
e4a8662d439ee680d42971b9a2d85fc05c3f3332a63aae59d86939845f59fcb4
-
SHA512
ec494363b29b530c220a47586f4d798647487056cd69fe10d02589ddaca998bb351f6c2489ff6ea50e03a12982f0b03f5a0949d2b5247d29ac87f8de78b6d1be
-
SSDEEP
12288:x7TbvGeNiKXPwIWIo75lLhJ0S76kJUKZvHoWkrA3TouZUZSCQE:xq+XPg7/V6c5dIJuT
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE 3 IoCs
Processes:
rar.exerar.exelsess.exepid Process 3788 rar.exe 4496 rar.exe 1712 lsess.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
regedit.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx\windows\Entry1 = "c:\\windows\\web\\printers\\123.bat" regedit.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.exedescription ioc Process File opened (read-only) \??\e: cmd.exe File opened (read-only) \??\g: cmd.exe File opened (read-only) \??\h: cmd.exe -
Drops file in Windows directory 47 IoCs
Processes:
rar.execmd.exee5616e35325978498fbbda48538ab23f_JaffaCakes118.exeattrib.exerar.exedescription ioc Process File created \??\c:\windows\web\printers\1.reg rar.exe File opened for modification \??\c:\windows\web\printers\3.reg rar.exe File opened for modification \??\c:\windows\web\printers\360s.txt rar.exe File opened for modification \??\c:\windows\web\printers\bb.vbs rar.exe File created \??\c:\windows\web\printers\QQlog.exe rar.exe File created \??\c:\windows\ztop\svchost.exe cmd.exe File created \??\c:\windows\web\printers\125.bat e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File opened for modification \??\c:\windows\web\printers\4.reg rar.exe File created \??\c:\windows\web\printers\bb.vbs rar.exe File created \??\c:\windows\web\printers\k.bat rar.exe File opened for modification \??\c:\windows\web\printers\QQlog.exe rar.exe File opened for modification C:\windows\web\printers attrib.exe File created \??\c:\windows\web\printers\abc.vbs rar.exe File created \??\c:\windows\web\printers\gl.txt rar.exe File created \??\c:\windows\web\printers\svc.bat rar.exe File opened for modification \??\c:\windows\web\printers\SVCH0ST.ini rar.exe File created \??\c:\windows\web\printers\md5.txt cmd.exe File opened for modification \??\c:\windows\web\printers\rar.exe e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File opened for modification \??\c:\windows\web\printers\124.bat rar.exe File opened for modification \??\c:\windows\web\printers\jinshan.vbs rar.exe File opened for modification \??\c:\windows\ztop\svchost.exe cmd.exe File created \??\c:\windows\dell\lsess.exe cmd.exe File opened for modification \??\c:\windows\web\printers\1.reg rar.exe File opened for modification \??\c:\windows\web\printers\abc.vbs rar.exe File opened for modification \??\c:\windows\web\printers\gl.txt rar.exe File opened for modification \??\c:\windows\web\printers\usbhard.rar e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File created \??\c:\windows\web\printers\5.reg rar.exe File created \??\c:\windows\web\printers\4.reg rar.exe File created \??\c:\windows\web\printers\123.bat rar.exe File created \??\c:\windows\web\printers\jin.vbs rar.exe File opened for modification \??\c:\windows\web\printers\svc.bat rar.exe File created \??\c:\windows\dell\lsess.txt rar.exe File opened for modification \??\c:\windows\dell\lsess.exe cmd.exe File opened for modification \??\c:\windows\web\printers\zzz.rar e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File created \??\c:\windows\web\printers\3.reg rar.exe File opened for modification \??\c:\windows\web\printers\123.bat rar.exe File created \??\c:\windows\web\printers\360s.txt rar.exe File opened for modification \??\c:\windows\web\printers\jin.vbs rar.exe File created \??\c:\windows\web\printers\SVCH0ST.ini rar.exe File opened for modification \??\c:\windows\web\printers\SVCH0ST.EXE rar.exe File opened for modification \??\c:\windows\dell\lsess.txt rar.exe File opened for modification \??\c:\windows\intell\1.txt e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe File opened for modification \??\c:\windows\web\printers\5.reg rar.exe File created \??\c:\windows\web\printers\124.bat rar.exe File created \??\c:\windows\web\printers\jinshan.vbs rar.exe File opened for modification \??\c:\windows\web\printers\k.bat rar.exe File created \??\c:\windows\web\printers\SVCH0ST.EXE rar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs .reg file with regedit 3 IoCs
Processes:
regedit.exeregedit.exeregedit.exepid Process 4416 regedit.exe 3996 regedit.exe 2840 regedit.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lsess.exedescription pid Process Token: SeDebugPrivilege 1712 lsess.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e5616e35325978498fbbda48538ab23f_JaffaCakes118.exepid Process 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
e5616e35325978498fbbda48538ab23f_JaffaCakes118.execmd.execmd.exedescription pid Process procid_target PID 1720 wrote to memory of 2240 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 93 PID 1720 wrote to memory of 2240 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 93 PID 1720 wrote to memory of 2240 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 93 PID 2240 wrote to memory of 3788 2240 cmd.exe 95 PID 2240 wrote to memory of 3788 2240 cmd.exe 95 PID 2240 wrote to memory of 3788 2240 cmd.exe 95 PID 2240 wrote to memory of 4484 2240 cmd.exe 96 PID 2240 wrote to memory of 4484 2240 cmd.exe 96 PID 2240 wrote to memory of 4484 2240 cmd.exe 96 PID 2240 wrote to memory of 4416 2240 cmd.exe 97 PID 2240 wrote to memory of 4416 2240 cmd.exe 97 PID 2240 wrote to memory of 4416 2240 cmd.exe 97 PID 2240 wrote to memory of 4496 2240 cmd.exe 98 PID 2240 wrote to memory of 4496 2240 cmd.exe 98 PID 2240 wrote to memory of 4496 2240 cmd.exe 98 PID 2240 wrote to memory of 1712 2240 cmd.exe 99 PID 2240 wrote to memory of 1712 2240 cmd.exe 99 PID 2240 wrote to memory of 1712 2240 cmd.exe 99 PID 1720 wrote to memory of 2196 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 101 PID 1720 wrote to memory of 2196 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 101 PID 1720 wrote to memory of 2196 1720 e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe 101 PID 2240 wrote to memory of 3996 2240 cmd.exe 103 PID 2240 wrote to memory of 3996 2240 cmd.exe 103 PID 2240 wrote to memory of 3996 2240 cmd.exe 103 PID 2196 wrote to memory of 4588 2196 cmd.exe 104 PID 2196 wrote to memory of 4588 2196 cmd.exe 104 PID 2196 wrote to memory of 4588 2196 cmd.exe 104 PID 2240 wrote to memory of 2840 2240 cmd.exe 105 PID 2240 wrote to memory of 2840 2240 cmd.exe 105 PID 2240 wrote to memory of 2840 2240 cmd.exe 105 PID 2196 wrote to memory of 4908 2196 cmd.exe 106 PID 2196 wrote to memory of 4908 2196 cmd.exe 106 PID 2196 wrote to memory of 4908 2196 cmd.exe 106 PID 2240 wrote to memory of 5072 2240 cmd.exe 110 PID 2240 wrote to memory of 5072 2240 cmd.exe 110 PID 2240 wrote to memory of 5072 2240 cmd.exe 110 PID 2240 wrote to memory of 2188 2240 cmd.exe 111 PID 2240 wrote to memory of 2188 2240 cmd.exe 111 PID 2240 wrote to memory of 2188 2240 cmd.exe 111 PID 2240 wrote to memory of 4436 2240 cmd.exe 112 PID 2240 wrote to memory of 4436 2240 cmd.exe 112 PID 2240 wrote to memory of 4436 2240 cmd.exe 112 PID 2240 wrote to memory of 4892 2240 cmd.exe 113 PID 2240 wrote to memory of 4892 2240 cmd.exe 113 PID 2240 wrote to memory of 4892 2240 cmd.exe 113 PID 2240 wrote to memory of 8 2240 cmd.exe 114 PID 2240 wrote to memory of 8 2240 cmd.exe 114 PID 2240 wrote to memory of 8 2240 cmd.exe 114 PID 2240 wrote to memory of 920 2240 cmd.exe 115 PID 2240 wrote to memory of 920 2240 cmd.exe 115 PID 2240 wrote to memory of 920 2240 cmd.exe 115 PID 2240 wrote to memory of 4440 2240 cmd.exe 116 PID 2240 wrote to memory of 4440 2240 cmd.exe 116 PID 2240 wrote to memory of 4440 2240 cmd.exe 116 PID 2240 wrote to memory of 4864 2240 cmd.exe 117 PID 2240 wrote to memory of 4864 2240 cmd.exe 117 PID 2240 wrote to memory of 4864 2240 cmd.exe 117 PID 2240 wrote to memory of 4856 2240 cmd.exe 118 PID 2240 wrote to memory of 4856 2240 cmd.exe 118 PID 2240 wrote to memory of 4856 2240 cmd.exe 118 PID 2240 wrote to memory of 2072 2240 cmd.exe 119 PID 2240 wrote to memory of 2072 2240 cmd.exe 119 PID 2240 wrote to memory of 2072 2240 cmd.exe 119 -
Views/modifies file attributes 1 TTPs 12 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid Process 4856 attrib.exe 4908 attrib.exe 5072 attrib.exe 2188 attrib.exe 4436 attrib.exe 920 attrib.exe 4440 attrib.exe 4484 attrib.exe 4892 attrib.exe 8 attrib.exe 4864 attrib.exe 2072 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5616e35325978498fbbda48538ab23f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\web\printers\125.bat2⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\windows\web\printers\rar.exe"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\usbhard.rar c:\windows\web\printers\3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib +R +A +S +H c:\windows\web\printers3⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:4484
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\windows\web\printers\1.reg3⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:4416
-
-
\??\c:\windows\web\printers\rar.exe"c:\windows\web\printers\Rar.exe" e -y -ping c:\windows\web\printers\zzz.rar c:\windows\dell\3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4496
-
-
\??\c:\windows\dell\lsess.exec:\windows\dell\lsess.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\windows\web\printers\5.reg3⤵
- Runs .reg file with regedit
PID:3996
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s c:\windows\web\printers\2.reg3⤵
- Runs .reg file with regedit
PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R d:\~13⤵
- Views/modifies file attributes
PID:5072
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R d:\setprter3⤵
- Views/modifies file attributes
PID:2188
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R e:\~13⤵
- Views/modifies file attributes
PID:4436
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R e:\setprter3⤵
- Views/modifies file attributes
PID:4892
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R f:\~13⤵
- Views/modifies file attributes
PID:8
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R f:\setprter3⤵
- Views/modifies file attributes
PID:920
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R g:\~13⤵
- Views/modifies file attributes
PID:4440
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R g:\setprter3⤵
- Views/modifies file attributes
PID:4864
-
-
C:\Windows\SysWOW64\attrib.exeattrib -H -R h:\~13⤵
- Views/modifies file attributes
PID:4856
-
-
C:\Windows\SysWOW64\attrib.exeattrib +H +R h:\setprter3⤵
- Views/modifies file attributes
PID:2072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\11a.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
PID:4588
-
-
C:\Windows\SysWOW64\attrib.exeattrib -S -H c:\ma.exe3⤵
- Views/modifies file attributes
PID:4908
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD51a9684b0cdbceae5e4434fbd91397b17
SHA1fe71fb9dea1398da3b6563dad519e32672eed153
SHA256d36c606fa22faeb752cec3528690c6bab9fd536b1a441520597251886c60cc9f
SHA5127f7255e1825ed44fc579b660d35d0afcff4ec01910d59dcdb3636421afb28080d54cb11d39ac1c7374462e96beff69df973a835cbb589342c1eaea398376eab8
-
Filesize
310KB
MD50a5680183c0089a64621e211917664d8
SHA18525d73c99e28413e97a094c99950e1806786246
SHA256c7d6bfe9d26d1ecdd9f2e7f3f892a4d32030949937f86938edcb1995655c2814
SHA512b843b8994c764c3761bef8d34eefb312c9d9567b3f4aadc38008caf42d0cdb82c33276203e4210adcc1e8c567268ebdf01a0a1e839694811932889ac971bb051
-
Filesize
46.0MB
MD5899ca2b54a11957975db2f3488931b29
SHA1e5bb0ae61c8c43428e5e431ea929c0cc2b289bea
SHA256842ed3c90d2ae70b684b8895632b3fc767025ad83106564a461c692fbf77920f
SHA51280ca235dfd2f4a9f1159b871b449259414a23da6f7257118f77ff9d5512add7129d48a6ca50aa5e860e25969db4359d86d1a9e52ac94a297a5fd936513e1ba7c
-
Filesize
45KB
MD54ad724ba8346d8556e6e884727c0523e
SHA1b53e2ec83b5b8441667b980fe6a53d69987fca89
SHA25648c52c0934097cdd0aea155be18a2006f2dd6884d623a51b00baf3e5de3e1412
SHA512fde2fb90a19fa00d040ade516fef8ca5f4463aee1a8af2fc85f41c3e818365086ff12491c330c8598bf071270bdbd863bbcdb5a5dde3d2523fbd1f6182eb33f3
-
Filesize
22KB
MD53619b2192d1e0d4907f7d4702b4aa9e1
SHA11bb317bea13bb457d9ec71294e5c07c93cc9b8e6
SHA2567da095327a1e11369d67d4f15d7c2e84cce9fb5d4cbac42d9b70bf0976300893
SHA5128f2d8420dc2e92a4df42eab89bb612b2562ff6d152c4a6f651c64371089506673bf9f02a37ff1c3ad53a9ae0fe51aa9c47dcdb7e01a319df51306d58a601b7ff
-
Filesize
46.0MB
MD5e3c1cea3611ee18e5a552572aca79afa
SHA1ab192e6c373481e42be63c60f61635fbf73e6c87
SHA25657d04fde12b8682361f61a731fc413fd1a6e8e30434fb89d4b4755d7783d2462
SHA51250a9104168b76c9bd79f08f672f9156226ef33e1ba2ece677b06ba544159623f10032b7bae332505598daee5dad17a2bbfb7b1099d7f46ef38f7f0d655433778
-
Filesize
1KB
MD51af018ff177dfbae562ac429cff786cb
SHA181f09865306d8c91d59bbec8a11ac874816f102c
SHA256dda4aa27c7fd4b793bcadbd94c47dc997d66e293f910af3826de893b0381914a
SHA512a76fba548576d2c99dac7e040bb140e29a68f55ee024174018345c4236e2a7ebda96d5ed1b66da85ae60d20485847e3cd38d34262be6c45475938f8d2182ab22
-
Filesize
33.7MB
MD5d3c91ba79104275b8fc182c6e32a7cff
SHA1094069eacd5d0fb117a40e310beb2b4aa4590420
SHA256ceae80f544d3ec3ab1211773c601f1ca6eb8319a9e62960bb1fe98ddfbfe0553
SHA51299cc0918b6029b35dd3a7fbcf8dd50b34c05364e7c4045c5dab7b206f510a95ac428a2fd59137ae1b0279d016f6d6bf0440ae8e5a063b1c32594c070b91a1241
-
Filesize
236KB
MD5a0f784ad499c07a7b7c3a48fab5afd0b
SHA18194f876410f89d3e4cc9ad1f86c89d1138b0d6c
SHA25689c23b96ac3837d3ee68ff0684f57e14cee8fc3ac3171d65c173ba6417411335
SHA512a13b015ec263073ddd2aa5ad116f65f7ae38dc592d6fba9ab2fc3dc034c483d53077c83005b9214cecbf8201a5cd50baea33824136903c0604c5cf6ade2f39de
-
Filesize
266KB
MD543f37b9978d9e49e49a0631ac0e6ce73
SHA11ee18c506fa9f66fbe0032aaf5474b3d402f2d81
SHA256433126adae9cd4c985ce970704d4f581fb1c0a3531279c28a89c4f4a7559af3b
SHA512ac93f47dd5281e3c8345a0062d02bdf55d7b70f49a21729d7f2cafa03cf2909261d6ab4ce2d2eebc2c971964fdccce5736702fc1aab640b76708d5baac1a8477