62b47f108b808d73be93bd323710a63252697d465701ac0e591a3b162fac2a10

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe
Size

455KB
MD5

f3e0c97a1e0e64bc94507da8c33c0c3c
SHA1

cfa9da0e05afa966ea867fb02ea6e730d2cf5bcc
SHA256

62b47f108b808d73be93bd323710a63252697d465701ac0e591a3b162fac2a10
SHA512

2102a82fba5628997b7d9cf06e252dd22cdbac143fa0e7da9b6d19c49901a58e4e0802653b2b8e788aa340d0929a2a21613dc1415054afce2199285cb352ec55
SSDEEP

12288:B5hV+0nRiW4SdUzWAenWRHcfoQwYl4Kb+YdoGP:B5hV+0nRiMHnWRHcfs64Kb+IoGP

Score

7^/10

spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2956	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2960	Logo1_.exe
2600	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2956	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Sidebar\sidebar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\misc.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	Logo1_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe
File created	C:\Windows\virDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2960	Logo1_.exe
2960	Logo1_.exe
2960	Logo1_.exe
2960	Logo1_.exe
2960	Logo1_.exe
2960	Logo1_.exe
2960	Logo1_.exe
2960	Logo1_.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2956	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2956	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2956	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2956	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	28
PID 2384 wrote to memory of 2960	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	29
PID 2384 wrote to memory of 2960	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	29
PID 2384 wrote to memory of 2960	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	29
PID 2384 wrote to memory of 2960	2384	f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe	29
PID 2960 wrote to memory of 1200	2960	Logo1_.exe	21
PID 2960 wrote to memory of 1200	2960	Logo1_.exe	21
PID 2956 wrote to memory of 2600	2956	cmd.exe	31
PID 2956 wrote to memory of 2600	2956	cmd.exe	31
PID 2956 wrote to memory of 2600	2956	cmd.exe	31
PID 2956 wrote to memory of 2600	2956	cmd.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1249.bat
    3⤵
    - Deletes itself
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      PID:2600
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a1249.bat

Filesize
614B

MD5
98e00fd98c7db0e9abc162d51078895d

SHA1
533bfdc90f9e9ff63198f2b50ded824bc414fd61

SHA256
2e7f52d453f3c8c2126f9701078e101d598fb2fe54bd644fa3faf6e40a4d993c

SHA512
d16f5c5d1ae7d77d6918a25db02bdd72c2ffd5780d86d52134becb7a869d0b094012dd806c4b59c1bb6f56f6bf97617439d9b946bae503c9818e74c7ebfb95cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3e0c97a1e0e64bc94507da8c33c0c3c_JaffaCakes118.exe.exe

Filesize
397KB

MD5
5bbe43a54b8facc512f295204bcc6500

SHA1
f120f40a14a02760a4fd01406fd7d1deaf0c4cd9

SHA256
bf66dd32c448f5e80506c8cc9655dec8683f6047f998b0957f4660fc82668e10

SHA512
373a04f76073a8b3d65459e2aeccf0a83f96cc299d17a04fd5ccbfb9446e23e0842f2dcffa8335d34e664eb59f16ffe2138e5297f2e1b0dcb54ca0b0ca9dfafc

Download Submit
C:\Windows\Logo1_.exe

Filesize
58KB

MD5
57bd08d8c6a16851a4afd0d8721b761b

SHA1
c5cddfe47144ef3894b5a8c79223d517caeaa6eb

SHA256
718ca7af3c380624a309ed03974e1f5bd6b37fd51f0c94426d2a068340842a40

SHA512
6ede6d4b40b5aff48a7c5e04e7eb467a7afad2866f949e0568dfd40f2371da7ecbd492cb780a4d22b61798b7e1ee319fedd17efb506b329cdb6cd1807c680044

Download Submit
memory/1200-19-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2384-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2960-240-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download