Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d688a340441d370588dd0faf0c528976_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
d688a340441d370588dd0faf0c528976_JaffaCakes118.exe
-
Size
406KB
-
MD5
d688a340441d370588dd0faf0c528976
-
SHA1
3d5f6ab68517fcb4bf29daea374062cdc1089edf
-
SHA256
fd3930ade2ad5f3d7ce6d0a89cfb934e07c18090679904dcb068d790c559170d
-
SHA512
b6e1d230affd24ad95623a87443a07fe37a1beb7386c5514a45bfbf0294da38b63c6d06336739c3c9e0537d3a8b350a65f75c0017ee8c27e65742055aa750fb5
-
SSDEEP
12288:itxqBTfXKy/TNxDvb3NbIsnlpRkIg8jZMkIqWM1E56:exW/ZTLrrJkKMdqWMi56
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2376 eqs9AB9.tmp -
Loads dropped DLL 9 IoCs
pid Process 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe 2872 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\RCXF36A.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXF28C.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXF996.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXF05F.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXF0F7.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXF208.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\RCXF23D.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RCXF447.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\RCXF803.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\RCXF344.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXF137.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\RCXF357.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\RCXF420.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXF877.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXF075.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXF0E4.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\RCXF3F8.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXF865.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXF1CA.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RCXEF87.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RCXF274.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXF10C.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\RCXF5CE.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCXF31E.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXF9DB.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXFA21.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXFAFB.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXFAFA.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXF998.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXF29D.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMC.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXF138.tmp d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe d688a340441d370588dd0faf0c528976_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2872 2376 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d688a340441d370588dd0faf0c528976_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eqs9AB9.tmp -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2376 eqs9AB9.tmp 2376 eqs9AB9.tmp -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2376 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 30 PID 1696 wrote to memory of 2376 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 30 PID 1696 wrote to memory of 2376 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 30 PID 1696 wrote to memory of 2376 1696 d688a340441d370588dd0faf0c528976_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2872 2376 eqs9AB9.tmp 31 PID 2376 wrote to memory of 2872 2376 eqs9AB9.tmp 31 PID 2376 wrote to memory of 2872 2376 eqs9AB9.tmp 31 PID 2376 wrote to memory of 2872 2376 eqs9AB9.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d688a340441d370588dd0faf0c528976_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d688a340441d370588dd0faf0c528976_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\eqs9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\d688a340441d370588dd0faf0c528976_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1763⤵
- Loads dropped DLL
- Program crash
PID:2872
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD5bf0ffd0ae568300617bad1a389911b56
SHA13030d601629504b6e1d45c557690b24a787227ec
SHA2560801299895ea96621ca67dbb2f602fbada6dbf471591084358fb59f99e237a88
SHA5129095c9b4380a7b6fab5de1d267a9439450a32e4472ea61aa0e26e9611cdff5431d6bbdb0bf0ecda6423b74fcf3e09dd2b6264e6500b0269a6ac919c4fb28506d
-
Filesize
12KB
MD5aa08e94834828337c60c23d63ec8af5f
SHA19e23ab8f4a5075614274b5a10530149e2260560d
SHA256e5698ffda00cbfdc03b674fd751ba062436a474ebfa7214977d3795796e9da5a
SHA512732763151c65a865c811b6dc2e0d9a9cceeb2d0e800950110d75f9e8c143fe74ee15da2c629762ef98c130dc264a188bd33396f71255e2f0489f5ea7ec8baf12
-
Filesize
16KB
MD59214178779d1764b1b26ec36211ca00e
SHA1d36e4a3a2d7a5f47ff6e7c55984c5231f4123acb
SHA256cf13da778562ddaf32cb3915fef8fb0a9a4ae90318cf8a3782c8f360f195a9ad
SHA512edcb4d717fa0dbb0d28709a38653b658f72e6107d8b5dd99db87b4142b8f9fd38d27cd21ae18c7837b7b36096a955317df52248a07c477b84f4c69a2b5514235
-
Filesize
333KB
MD59ccd7d633b58589c239aea2d0b10b77c
SHA1216ac8951c272f3b2fa78a4d5fe074ac4c6922cf
SHA256dd7747c5eb6c943bfd3dd5f773a020e71299928b4738db9b0495e01be554e417
SHA5128370b34cbb04548e21628ce3ec96a1364d13194549aea545d1f8140536289b8cbdd31dea96f3c5eda72353b49fb784612fede2c194d5c6cbb84851cf6bc50c90