1f69be54fd5383d9292a8f49fb9ae70535529cc7d3869fdbe7e883c5ef53f2ee

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
Size

411KB
MD5

2f36e569ed0d9a0068fc8d4903d633ac
SHA1

90a4957b28b2a0a138fd876d338954dd16627f8a
SHA256

1f69be54fd5383d9292a8f49fb9ae70535529cc7d3869fdbe7e883c5ef53f2ee
SHA512

be8d08d53a250162f8e83a23172418fde35502dc6d6775a1fd6f2143cb82ea51d757bd29fe243be2dcdc96203ec287c18bfad264508dc9d38de87cf22cbd69ad
SSDEEP

6144:MGzvhewVudv8B8MIFEoVJer7neEegbqg2blDRcMZmTOoTRqqG38in:Tz5RIdvW8MNqJerve22b1RbuxG

Score

9^/10

spyware stealer upx

Malware Config

Signatures

Nirsoft 4 IoCs

resource	yara_rule
behavioral1/memory/2744-17-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral1/memory/2932-25-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2932-27-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2172-42-0x0000000000400000-0x000000000043D000-memory.dmp	Nirsoft

Executes dropped EXE 4 IoCs

pid	Process
2744	Java Update.exe
2932	Windows Defender.exe
2172	Microsoft_Update.exe
3048	winlogon.exe

Loads dropped DLL 6 IoCs

pid	Process
2744	Java Update.exe
2744	Java Update.exe
2744	Java Update.exe
2172	Microsoft_Update.exe
2172	Microsoft_Update.exe
2172	Microsoft_Update.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000900000001958b-10.dat	upx
behavioral1/memory/2744-12-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2744-17-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2744-19-0x0000000000240000-0x0000000000265000-memory.dmp	upx
behavioral1/files/0x000500000001a46d-24.dat	upx
behavioral1/memory/2932-25-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2932-27-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000500000001a472-31.dat	upx
behavioral1/memory/2172-42-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2172-36-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	whatismyip.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\WINDOWS\System32\explorer\cd.txt	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer\pic\Img%.jpeg	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
File created	C:\Windows\System32\explorer\Windows Update.exe	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer\winlogon.exe	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
File created	C:\WINDOWS\System32\explorer\Decrypt.txt	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
3048	winlogon.exe
3048	winlogon.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
Token: 33	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
Token: SeDebugPrivilege	2744	Java Update.exe
Token: SeDebugPrivilege	2932	Windows Defender.exe
Token: SeRestorePrivilege	2932	Windows Defender.exe
Token: SeBackupPrivilege	2932	Windows Defender.exe
Token: SeDebugPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe
Token: 33	3048	winlogon.exe
Token: SeIncBasePriorityPrivilege	3048	winlogon.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2744	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2932	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2932	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2932	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2932	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2172	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	32
PID 2916 wrote to memory of 3048	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	33
PID 2916 wrote to memory of 3048	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	33
PID 2916 wrote to memory of 3048	2916	2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f36e569ed0d9a0068fc8d4903d633ac_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\Java Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Java Update.exe" /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe" /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe
  C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2172
- C:\WINDOWS\system32\explorer\winlogon.exe
  C:\WINDOWS\system32\explorer\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ChromePass.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Java Update.exe

Filesize
63KB

MD5
fbb93d4c91453b06414d6973152d904e

SHA1
4624232c5450e7e9e7ba1f2113a07f8800dc5b5f

SHA256
8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe

SHA512
4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe

Filesize
125KB

MD5
9b3b1c0db965166319469b2afa6c4f0c

SHA1
9f1e65a3056dff872949329c4e5e70c007cc5621

SHA256
dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89

SHA512
c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe

Filesize
42KB

MD5
28c110b8d0ad095131c8d06043678086

SHA1
c684cf321e890e0e766a97609a4cde866156d6c5

SHA256
dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1

SHA512
065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

Download Submit
C:\WINDOWS\system32\explorer\winlogon.exe

Filesize
411KB

MD5
2f36e569ed0d9a0068fc8d4903d633ac

SHA1
90a4957b28b2a0a138fd876d338954dd16627f8a

SHA256
1f69be54fd5383d9292a8f49fb9ae70535529cc7d3869fdbe7e883c5ef53f2ee

SHA512
be8d08d53a250162f8e83a23172418fde35502dc6d6775a1fd6f2143cb82ea51d757bd29fe243be2dcdc96203ec287c18bfad264508dc9d38de87cf22cbd69ad

Download Submit
memory/2172-36-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2172-38-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/2172-37-0x0000000000240000-0x000000000027D000-memory.dmp

Filesize
244KB

Download
memory/2172-42-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2744-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2744-17-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2744-19-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download
memory/2744-58-0x0000000000240000-0x0000000000265000-memory.dmp

Filesize
148KB

Download
memory/2916-6-0x000000001B5A0000-0x000000001B5E0000-memory.dmp

Filesize
256KB

Download
memory/2916-0-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Filesize
4KB

Download
memory/2916-5-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-4-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-3-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-43-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Filesize
4KB

Download
memory/2916-44-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-2-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-57-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-1-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/2932-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2932-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download