Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 23:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
General
-
Target
ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe
-
Size
82KB
-
MD5
ec43f40c31a889034b6c31588da5c64c
-
SHA1
acd4d746dce75ae97c3aae8e741b88d1f9d06c5a
-
SHA256
e1878830854fcc655a72c96084615920a820480cf69127943494ea0a7b248373
-
SHA512
384b05dbdd493a419fab3a07229f17944714815d64216f863c6fc1d0f2569acf013156a3ddcf133dc49660a2d7fa2b15e379253567b8b2a58c61545960013f29
-
SSDEEP
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitD+Xue9hwn0Bt5io:qKtfDwsjPThTYszDH2fle9hwn8v
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4712 Logo1_.exe 4324 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\notification_click_helper.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe 4712 Logo1_.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2844 wrote to memory of 3508 2844 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe 91 PID 2844 wrote to memory of 3508 2844 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe 91 PID 2844 wrote to memory of 3508 2844 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe 91 PID 2844 wrote to memory of 4712 2844 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe 92 PID 2844 wrote to memory of 4712 2844 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe 92 PID 2844 wrote to memory of 4712 2844 ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe 92 PID 4712 wrote to memory of 3556 4712 Logo1_.exe 57 PID 4712 wrote to memory of 3556 4712 Logo1_.exe 57 PID 3508 wrote to memory of 4324 3508 cmd.exe 94 PID 3508 wrote to memory of 4324 3508 cmd.exe 94 PID 3508 wrote to memory of 4324 3508 cmd.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BAA.bat3⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec43f40c31a889034b6c31588da5c64c_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:4324
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:81⤵PID:112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989KB
MD5f07be78e0ad355e65ba2ce5a1483fbab
SHA138fdf7a17ff128326adf437902be434b722781be
SHA25611de308350886d8390f27e00570ef6055c9eb0ae2e484009c000bf7cce7c8f82
SHA5120ca4c59cf8207a0a7daeee788f74206f8b6737c9d58ad34a7d6fd6056d45fe655aa452df2c8867459e0c8698bec61595db854e65f548242e8bd115d29b68e993
-
Filesize
614B
MD5d500e927cbc2ff50aafb296cd6db3f76
SHA14da8535989b793eb5d2e2266fa38c83a46317bd7
SHA256673694e2970287c0a07cf5d572912a26d0c41da45a1620557b4b3ac6709dfe51
SHA51275917b4f93763a83565c8e1091060239334b3e873991cd0c590ba6d101510bb6e2e12736b3bfbb66a54c6c81b7adbe686a4863943ba50f73dbd59b064e005d7f
-
Filesize
23KB
MD54f7133b1963be15aba28474f280a96ed
SHA16d55b874085219c6564d986b6bf17c6d1e55e95c
SHA256c15341115908fdda3bdae7021930a088b1652a2fbaa992da7471fc315d1c0c03
SHA5129f36e21c823eefe52cd11c69a847d394b135c4de02fcc27b4365fd98bc4236ba8252c688753b2499cb14900dd67f22e894248c2ee0ce5ebb817c8d2b4c4e66cd
-
Filesize
58KB
MD5d0d61c67293a445db5948849adae35ab
SHA1bfba28b28f49d507a45565c957ba09f7473a44bb
SHA2567bf80d6f1f51ba8dd4658d5c902d648d94fbba8e8e7fac8f4df4dbe29293f6e6
SHA51246c1c4025bf8f616be76c9a5cc2ec8cc96ea095923a1665905cc847c9dfcbfaba12570eab765cdc0954069492c3098a5113abfcb0888376ddf19ce6ce7c7f786