Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
ebd655aa7f8b4d4efe09d73fff120bbd
-
SHA1
6d7576b7a8af97b04aea0d9f3a55da750dcca121
-
SHA256
bc43ee0eff59c762cf1b1c6cdabc578f83c36646ce4936797dcdb30b756975ba
-
SHA512
ff1f016a7e8592478ba7669758fa2d680b237a247d0295d6f5b3cdbd41bdb496ede0758d719c1e8bc60ebcd614612dbb7f69fc75e90eaa97b9fc0377ee76ae98
-
SSDEEP
196608:QlMlTiAuFyspTje2axQsUBUJ1hnYwMr+39RIFwacGKjv:QOTZ6VjaQbUHhTMrcJacGKT
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2960 servbrow.exe 1652 servbrow.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 14 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\hm[1].js servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\tj[1].js servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\45A10OFH.txt servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\45A10OFH.txt servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 servbrow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EQ654QNO.htm servbrow.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\common[1].js servbrow.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe File created C:\Program Files\7-Zip\Ws2Help.dll ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Ws2Help.dll ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\Ws2Help.dll ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\Ws2Help.dll ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\servbrow.exe ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-7a-13-07-66-07 servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" servbrow.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-7a-13-07-66-07\WpadDecisionReason = "1" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7720BE3-4D55-4D47-B9E5-ED7F7AF724CE}\WpadDecisionReason = "1" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" servbrow.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7720BE3-4D55-4D47-B9E5-ED7F7AF724CE}\WpadDecisionTime = 602f06c57e8bda01 servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7720BE3-4D55-4D47-B9E5-ED7F7AF724CE}\0a-7a-13-07-66-07 servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix servbrow.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-7a-13-07-66-07\WpadDecisionTime = 602f06c57e8bda01 servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7720BE3-4D55-4D47-B9E5-ED7F7AF724CE}\WpadDecision = "0" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7720BE3-4D55-4D47-B9E5-ED7F7AF724CE} servbrow.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D7720BE3-4D55-4D47-B9E5-ED7F7AF724CE}\WpadNetworkName = "Network 3" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs servbrow.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 servbrow.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 servbrow.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-7a-13-07-66-07\WpadDecision = "0" servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs servbrow.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs servbrow.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTcbPrivilege 2960 servbrow.exe Token: SeChangeNotifyPrivilege 2960 servbrow.exe Token: SeIncreaseQuotaPrivilege 2960 servbrow.exe Token: SeAssignPrimaryTokenPrivilege 2960 servbrow.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe 2960 servbrow.exe 1652 servbrow.exe 1652 servbrow.exe 1652 servbrow.exe 1652 servbrow.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 1652 2960 servbrow.exe 31 PID 2960 wrote to memory of 1652 2960 servbrow.exe 31 PID 2960 wrote to memory of 1652 2960 servbrow.exe 31 PID 2960 wrote to memory of 1652 2960 servbrow.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2868
-
C:\Windows\servbrow.exe"C:\Windows\servbrow.exe" /Service1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\servbrow.exe"C:\Windows\servbrow.exe" /Popup2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.6MB
MD5e40074b1a7c60ab4470c62501ba7e10a
SHA1ddc2d661e06a981cbe78a32d470f5294cf011595
SHA2560b488b2e3c0e997556d1ce96e1060cb245caaa8f32177c27b1691d3a7c078882
SHA5125e4dfa2d8d5530fc749ca2a1858c159c3daf38843cb98cb612ec6f97e82894a21e22ea10c41f0f981b5b84fcbc914653dbb113e8b162cc4e3913acd7ba52d45b
-
Filesize
7.6MB
MD5ee9f3d14565232b7d3bcc9c9a776217d
SHA10dff145e811406981fa6429c5858587c39840295
SHA256a33ae81a71ef531692279f196bbf3e8607500ba22bcc34e69082909dac203bd1
SHA5122811768fbfb5e9cd28c7362e36a94a75485767a0a3e82d02d3bdf6b71773b1e9b90042e2b5c81b0a9f0296713905cfeeb7454fd8a654eede55ddd2e169569f66