1930a2efe2ab477ad2e503766ae4fbf0b15fc1fe2b76316de1b9f32793715707

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
Size

229KB
MD5

17a8208667e746f100921b9d45c264c9
SHA1

135a08bb0b340a170f426f623296c0fec969169e
SHA256

1930a2efe2ab477ad2e503766ae4fbf0b15fc1fe2b76316de1b9f32793715707
SHA512

2281b01c93f1823ffc5d578fff20b6a9e41bb4dd51f9bdba8620a7f0b1988305b0b74243fc2d0329ad1eaa28a590a2c6c304271731a688a520556e77d75293e5
SSDEEP

3072:ebHHjm3P7BkOWWLvmxJny8HxhC2bl1DsyOrExy:ebHjCkeLvH8pbl1Yy

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\Q:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\E:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\P:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\M:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\K:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\I:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\Y:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\J:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\T:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\S:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\R:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\O:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\X:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\W:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\V:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\U:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\N:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\L:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\H:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened (read-only)	\??\G:	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\ja-JP\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\es-ES\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\Network Sharing\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\MSBuild\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\_desktop.ini	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
File created	C:\Windows\Dll.dll	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1960	2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1960	2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1960	2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe	28
PID 2244 wrote to memory of 1960	2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe	28
PID 1960 wrote to memory of 2080	1960	net.exe	30
PID 1960 wrote to memory of 2080	1960	net.exe	30
PID 1960 wrote to memory of 2080	1960	net.exe	30
PID 1960 wrote to memory of 2080	1960	net.exe	30
PID 2244 wrote to memory of 1200	2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe	21
PID 2244 wrote to memory of 1200	2244	17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\17a8208667e746f100921b9d45c264c9_JaffaCakes118.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe

Filesize
562KB

MD5
f3d5b0ccd930a881669ab75d00bfdbb1

SHA1
027543dfd1420d28f7311970f95ca058c3334178

SHA256
80835b40f115fa6176dc96d8fca3812f3451cc599d6161ad8707a9d0511b51ba

SHA512
11758da31ade3462acf01c86679638c4d9943b0a3822bb1849a213d2818376ca0fece2e525dbb068ce27bff48008e8915d603d058f2e2a672e97bdf753e5f355

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\_desktop.ini

Filesize
9B

MD5
7d17b811a66f09661920bf5af1f95ae9

SHA1
f974fb71f0c9242357d308243f16d5509a0fb040

SHA256
1ffbf32a83283a76202c268eb3ea579c4b39aa6fb11fc42ad18318286fbf749c

SHA512
019689bb28dd360a9b3fe6696944854f806ebe877734f4f8533f7c2508d371049a96f6c7bd5dda908ab91686dbfba4a54335cbc6c4d649775e62912f0af730e3

Download Submit
memory/1200-5-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2244-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2244-4309-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download