Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 08:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe
-
Size
226KB
-
MD5
12939b3590d5aa3b4d8b50048e1955ca
-
SHA1
2f993fb018435f5365ef558f90ad6357a0bcf5e6
-
SHA256
8309eb9ecbfe0e5dca5070d94649340cf0406baedb940eeb062113f14fe30e58
-
SHA512
0552f17cd25692fa6a5ee4dcecbe2abea8de7e503969d7bbf036b2694bcf950cadcb4d2e10cd6b6156dd4a9acdf18b202cfb8e7e4c4a82998853d50c927dc24b
-
SSDEEP
3072:RAatf04xOIhMDy3EsLVqRwlKYNrsp6mpehe6beTSOJ8os9PHt4RSF:5tfrxOUMD0IMxe6bpOWP6cF
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 1208 Logo1_.exe 5032 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe 1208 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2036 wrote to memory of 3276 2036 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe 82 PID 2036 wrote to memory of 3276 2036 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe 82 PID 2036 wrote to memory of 3276 2036 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe 82 PID 2036 wrote to memory of 1208 2036 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe 83 PID 2036 wrote to memory of 1208 2036 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe 83 PID 2036 wrote to memory of 1208 2036 12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe 83 PID 1208 wrote to memory of 3644 1208 Logo1_.exe 85 PID 1208 wrote to memory of 3644 1208 Logo1_.exe 85 PID 1208 wrote to memory of 3644 1208 Logo1_.exe 85 PID 3644 wrote to memory of 4956 3644 net.exe 87 PID 3644 wrote to memory of 4956 3644 net.exe 87 PID 3644 wrote to memory of 4956 3644 net.exe 87 PID 3276 wrote to memory of 5032 3276 cmd.exe 88 PID 3276 wrote to memory of 5032 3276 cmd.exe 88 PID 3276 wrote to memory of 5032 3276 cmd.exe 88 PID 1208 wrote to memory of 3388 1208 Logo1_.exe 55 PID 1208 wrote to memory of 3388 1208 Logo1_.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D6B.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\12939b3590d5aa3b4d8b50048e1955ca_JaffaCakes118.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
- System Location Discovery: System Language Discovery
PID:4956
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
749KB
MD54d1a769a7387e987fde0a97685ad34be
SHA1c9f1bf22d03ef193fe82a0768e60d01b1f35a0ad
SHA2567b84dfae25eebe05a613d8176ce4f85a49a41eb6b2e41fdaefd682f5cae5da24
SHA51239554eb48cf0225e871e9fd755b6469f2d8840b3ecaf09968421358443edb50753abcac05280f168b17670b3a270aed36b10380fd793b674162ae463d10c6356
-
Filesize
614B
MD5072b05afb54a5ee47e1b27f79b0069bc
SHA116b3621342313c8aa5d6eada238cbdaa7d8dec43
SHA2563a7ec0b00da829b2edbb1d30694695eb43ab0196ac9a5d4d502f0a7128942e57
SHA5125d4bd6e944c3241976b32593f6ca69185a4368a7720543acb53f7dba73f759d646eb68990c4379fb83cec9907571cb5d3650ae879d75a08ab83a235b6e15b9ac
-
Filesize
161KB
MD580da5ee61048975f77fde0b59c44dc37
SHA18e34a677aec9b0b1686cff1dd5ac2d3d6af242da
SHA256bbc0eae226926b29c3e8e1ea629e612726cd358c5984cc45e4bdcd6f49be93bb
SHA5120188c8bdf324ce701d55eac4208d23a63ca40fa9b4d72f0e3c38d6fb92f10e1c5c25fa3798e2f91962e0e7d5147d7e4d3de0103e6960ffaea34e0ec6c0fd2fae
-
Filesize
65KB
MD5eed3b320cc57e0063bf83ad293477a03
SHA145d74dac2b5412f7bcc9e4f2ed729b5c853a7521
SHA2566343d379414c5ac16232a7f9399b7712deb2676bc0c521d358b09270f9949ff3
SHA5125901802a1c6b214ec2c35e2cdc46e3acac4bf3d6c22deca413827e88ccaad0d83984966045741fe8fef800b8394e6fde9921502be8c1429a2984ae0fe12beb57