Analysis
-
max time kernel
138s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 03:00
Behavioral task
behavioral1
Sample
88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
-
Size
134KB
-
MD5
88bcade2e5682e151ed994dde61b079e
-
SHA1
8a16ff02ecbc366342a377a26f1d1d0497b1788e
-
SHA256
35d99939ea17bd688e5b40d4b718b2f795a0677d676c95496c1f3009b13c366a
-
SHA512
353f2504f061bcca52d66110dd95afde2307c637e7d9a37664ba010c5d50e7984f4616572337caff00f411928e84be52c31283dd679219d0a292d1d41c39f94c
-
SSDEEP
3072:/jGKwgTLTCKFYnqqeVF8VUodWGTj3RvFWb0J8tgcnmujq2r:rqKF2qDVGVUodpTLhFyEtUfr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3576 TrustedInstaller.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1896-0-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000900000002348f-5.dat upx behavioral2/files/0x000100000001898c-12.dat upx behavioral2/memory/1896-19-0x0000000000400000-0x000000000044B000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\L: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\M: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\N: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\T: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\W: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\U: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\V: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\X: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\G: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\H: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\I: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\O: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\Q: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\Z: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\P: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\R: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\E: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\J: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\K: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened (read-only) \??\S: 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe -
Drops file in System32 directory 27 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File created \??\c:\windows\SysWOW64\msiexec.vir 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File created C:\Program Files\7-Zip\Uninstall.vir 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\program files\google\chrome\Application\123.0.6312.123\elevation_service.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe File created C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1896 88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88bcade2e5682e151ed994dde61b079e_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
527KB
MD5c2864b58d3a7d67f33a781c611ec9d77
SHA1c4b110ef1d9121e6269eddc4e307a7c30030ca5b
SHA2563b7320b0e7002aefc64630b8cb21b9e70126badd67763f62f8332e86e738cd0f
SHA512802e6a7e533b8158099b8e6a2b586d93ad4c3e4c33838af3fac7b0405621ba6598b7c5e5878c41a5fdd63001b6e5d6094edba5c9f544a88f41278fe113eb71db
-
Filesize
162KB
MD5df5acc492a162888e6a01a1a7bfa2cf9
SHA14e774dcf1616208943a22e13809cd7405b890902
SHA2569678ee280c16c7eba760d1b30b0b4cedba9409bef07d643ba36b52d9ffc3d7b1
SHA512aad19ed8c979addc7dda207fa6b92c26a5c59cab976b6ab55ea2e9e3d71e5e58358aedce22163b40a706430a594a4d24ea62265c825510fc9c66d378fe859cc3
-
Filesize
193KB
MD5805418acd5280e97074bdadca4d95195
SHA1a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6
SHA25673684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
SHA512630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de