bf6ff6b8d8892ad2b02f8a63a39186672a8111891b68756bd54fbacf894bf1ab

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
Size

168KB
MD5

76ba7b1e1b205619eb4e6f680dbde850
SHA1

45ccf94d76b9d4bfe84dd1acbc603473346c9a5f
SHA256

bf6ff6b8d8892ad2b02f8a63a39186672a8111891b68756bd54fbacf894bf1ab
SHA512

2ba415d4acc23f571e790ecb4d9027e70bec1ef07564d3d9e3c10b90a35486f70fa5a82b1e0af8e19a079a2697f3601653ab7e3e0e3dd01b35e83dcc9f4adff5
SSDEEP

3072:ChwEE7/ZBl9CJhGgVKd8S7PBfgpnrbj+9smbv+4tTiwFRxmfizrEpJ1M9MA2k/N4:ywEE7/ZBl9CJhGgVcfgdbj+Nfxmfizrw

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\U:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\W:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\Z:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\H:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\M:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\N:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\Q:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\X:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\Y:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\G:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\I:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\P:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\V:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\K:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\T:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\R:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\E:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\J:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\L:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened (read-only)	\??\O:	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\readme.eml	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2692	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2692	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2692	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2692	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	32
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21
PID 2372 wrote to memory of 1252	2372	76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Users\Admin\AppData\Local\Temp\76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\76ba7b1e1b205619eb4e6f680dbde850_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\readme.eml

Filesize
14KB

MD5
2d102bd131527d4192288195a957042c

SHA1
f0a670b04dd01337b23bca50b67ffd2f3b82cdea

SHA256
1b94dd573ad1d470f41c315b67d8bcd98cee1ae0ab7cbb7be2fc80440623306a

SHA512
49b88848cda4363826d0ef2dc388758b3d2661b9e5b9610bc2c934ca34aadccf922b152d35fa594f75d6dc65fd5d6cf1137744545e630646d84627187f031574

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
8156706568e77846b7bfbcc091c6ffeb

SHA1
792aa0db64f517520ee8f745bee71152532fe4d2

SHA256
5e19cfbd6690649d3349e585472385186d99f56a94dc32d9073b83011cea85f8

SHA512
8760f26069296f0fe09532f1244d93a57db4cafa8d06aaa9dc981bcaed4bde05366ef21e6f0c1aadad4478382b59a4e43d26c04185cf2ed965901321d05604b8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
7757fe48a0974cb625e89012c92cc995

SHA1
e4684021f14053c3f9526070dc687ff125251162

SHA256
c0a8aa811a50c9b592c8f7987c016e178c732d7ebfd11aa985a8f0480539fa03

SHA512
b3d4838b59f525078542e7ebbf77300d6f94e13b0bff1c9a2c5b44a66b89310a2593815703f9571565c18b0cdeb84e9e48432208aaa25dff9d2223722902d526

Download Submit
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe

Filesize
451KB

MD5
558a1726da68318461d4e1c9568e5caa

SHA1
c40669b993e95dae8c73486ca98789bd384afe42

SHA256
5c83bc839f16bfbf4ee38e629d010757f80a2a9916ea282ae9fee97d2926a8c0

SHA512
fdbe7cf60c37cbb8e45445fa312cdc238bc5671e63ddef670a8fd1f17eb8f54e09387c091beafef23e7f3922580d0faedf5f8c15e3ac3a021490b97acd62a6e8

Download Submit
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe

Filesize
640KB

MD5
433090652471e856ba7f55760280e075

SHA1
a430d8a74aeff1afe2719dec259503f98ff83226

SHA256
a281e55d2394c25a3985e481655de1f5c612ff7765c8ffe0499245f0e7a0d5f5

SHA512
0c1e55bd2ae7f50f977266f485738e0d4402a9a2559bcc6e0ce03e2605ea60992ab3cd0a255b2d9b0ad47a75bdf2ebf0420d1fbb051f27f89852cc3c4673d192

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

Filesize
640KB

MD5
9bf171229112eec43d370fdad1117790

SHA1
130d4da60367059f6d6e8e4b3a04da7d4fb02a8d

SHA256
2399a1fb11062b08ff103edcc6ae4f2bc188f232d8ceee087be961aecaed4501

SHA512
5032541678ce729ac08b6d37d03c6695cf89c835d271e827824830a579c0e21a689caa6ba6fafcd95e606e484b68b60b7de7ac60e7d4b61ac700e2b9d7e04a05

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe

Filesize
461KB

MD5
056ed6d82109305b92262d0524ce384f

SHA1
177ebcbce1828a74553b56dbfd1c825647eb1d09

SHA256
b670929966f030cbee8d95ef38916ee7df8906faf82b3dc4e5048c6265aea20e

SHA512
6ebb1b2bf16c81ef8cfc5e235de849b63a0dc869e736cecd00acad785430b533794faefff543906c0074a452ea4e2734f24c13fdadb146a1572b944db11cb841

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
451KB

MD5
be71ec1eca137f18efd10f12bd67d6b6

SHA1
c48ef287299ddb94a24586d3b9130280a08b83af

SHA256
750398093ff87bee880a606b850b0e6f37a235ecb862d1b5af5972a4431f0501

SHA512
fb24c51ac4307f0fae865358b426c1793f6f1c35aeee754bca06b07896d412d3ea3c8a11098d4cfbea5f16660960f0377c6247ccec9c55050a50e84f636600ea

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe

Filesize
461KB

MD5
ab5a13c256acc2598b20a227e29cac97

SHA1
41850def1d60e4d81701fd6d3b81dbd7f5bf3f56

SHA256
c376d58956b63734b50b0b3f23dcfb9011f3dfad45baa73f7c2b39b5ec969454

SHA512
689222e2471e2df66d75aaffc523a22682573557db23e66f843523dcc45fa2ff62da7d5e456b9088b9083cfafef8f5450a92043ea32814a9627ac251ddc06a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\ose00000.exe

Filesize
152KB

MD5
2464c29821b5eaef28abc72499d56513

SHA1
b91e887605cc6e88017cd2854907b300a1a61ca0

SHA256
31636e3f31571fbf99ec6d094c3e4c28ff5e47b7eaca82e4c2c6c6c69c71d8b3

SHA512
7821ceb5cdd7e2e406cf033267bf57a79eabb4bce958c9dbc8f066f7ce473910aab55a4629cf2ddd80d2693efa74e051b1c716f3dab9bdbd7f522155c9788650

Download Submit
C:\Windows\SysWOW64\runouce.exe

Filesize
10KB

MD5
f5287bb99b3b4fc6ecc08238ab319f7a

SHA1
1bc08ec0893e584bf7a88a804330cae8e73724b7

SHA256
952861fd60891987807e4c574ca4a0c46fb34aa5db95769cc652cc7ca43e2196

SHA512
0b60cf04644ae734e9c0a98b50d475012319697def49cf352c630111ecf8c1f3365c7c60fd24f22ac4d2e398e77991258a2ab8b029def32c41b5a6c3db9868ff

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
1e0debb0abde842b91f79aa72ba114f5

SHA1
b3fdb9bf7d904ed09ae8c9504c67276365c52586

SHA256
e52efae39cc0a7c4e335ddb7b2a1bdf1cefe1514a0b7c1fb4e95498ebb33c1f2

SHA512
e35a1c2f7c0d0af14eb1214b1003b4946f206b77b91574d3a1d1950b0dfaf566e6e119664761c40d9e10a3ce7ab041d7e4d7a17a41c4f5d2e4cf83f047d09660

Download Submit
memory/1252-2-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1252-3-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2372-656-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-849-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-850-0x00000000002C0000-0x00000000002EF000-memory.dmp

Filesize
188KB

Download
memory/2372-967-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-479-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-1028-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-1029-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-1030-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-1075-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads