Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 00:39
Static task
static1
Behavioral task
behavioral1
Sample
9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
9328cbaf393bd868720794b6137db9a8
-
SHA1
546f241a90b63853b18a5c0cbcafdb8828b2539f
-
SHA256
66685c4afa8d159b3f612be71271e25e07111a1e80b81831bd1ee3d03d3a9f11
-
SHA512
e9b77c5f8e480d6f1cb237cdabb9a582c6a445eebe50ebef68ea587a51f5b9b9f7aa71fd921e38425cf206d4253d8c8e601b89bbcde110533c8c7eb3a8dc8b00
-
SSDEEP
49152:b3NpfZfpWZNU5XstFviQJXZNhAj/WjntIVKLI7kxHKMPN//4JXTgRItETQSQ:b3ffZxWCSxHmJXT7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exepid process 2732 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe -
Loads dropped DLL 5 IoCs
Processes:
9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exepid process 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 2300 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 1328 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 2732 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exedescription ioc process File opened (read-only) \??\D: 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe File opened (read-only) \??\F: 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exedescription pid process target process PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2300 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 1328 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe PID 2288 wrote to memory of 2732 2288 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe 9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe" --crash-reporter-parent-id=22882⤵
- Loads dropped DLL
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=56.0.3051.31 --initial-client-data=0x10c,0x110,0x114,0x108,0x118,0x752ce360,0x752ce370,0x752ce37c2⤵
- Loads dropped DLL
PID:1328
-
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\9328cbaf393bd868720794b6137db9a8_JaffaCakes118.exe" --version2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574e9b039dafdce0cf8e45f0174a89a34
SHA19f3bd0d54e277e55242dae952effde8a6af8108a
SHA256942bacc22f48044d0fa989353860534a1600390069d0112f5741492878173e7f
SHA51295cfb76bd43a9057e1ff74b6ccb36bf5d3ee911900f9052cfa1e150454a375b6ea09a845066bc99d354bbe107aeb73feafdf8c4d138b8685336dbf6a042753f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f691e24b93ac439f32b7a34c21524be
SHA1c39d75183dfc394e993fb99b64a2a4cbe44c8963
SHA2569bd852d3ce25effe995d1bc9ccadb55d626b13cf5da231f99f5afdcc0d8c4dae
SHA512a8699418b8f58db711332fdeb3259db5bfb364a487b86eaaa36c273e76bb9593630f098e5b8ad80acd05ff8ea04cee09193b8981bfb9b76ee50da087bde00f85
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
40B
MD5e3bafceb63c9f97dcbdaad678c051ba2
SHA18bf73db1f4a7d2b9eb484e2b66715a4b2c85f1dc
SHA256828d9556bc9bc041f4190e9fc92aaa7dbe89661458e0a0f279724327b76dc5ba
SHA51207a2a4dabdd590489805188a55107a6886f4710f1d8910358d27cb0e3f006a9cabfa0ab0574890832702a30f3ec84ded9b8033b093aaab391c6cc4b1a330d605
-
Filesize
3.1MB
MD59328cbaf393bd868720794b6137db9a8
SHA1546f241a90b63853b18a5c0cbcafdb8828b2539f
SHA25666685c4afa8d159b3f612be71271e25e07111a1e80b81831bd1ee3d03d3a9f11
SHA512e9b77c5f8e480d6f1cb237cdabb9a582c6a445eebe50ebef68ea587a51f5b9b9f7aa71fd921e38425cf206d4253d8c8e601b89bbcde110533c8c7eb3a8dc8b00
-
Filesize
2.3MB
MD5d032b5dfbc2948f9501b730f64cafe12
SHA18e0a3e18b542e7cec52e219ab1443e64f56d7bcc
SHA25613044ba760abf383e1197bc046a9fe7f84d36bb9c6dcdd503fcc8e0acfa427ce
SHA5122c27fb659fa947894f9069cff15869a1cf323d663bf2fd4626eeb4b25d64ee24c8427e232f63c021c0d4a9511b82c5627fbfab0fd66b40eedf51c6b32b503482