Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe
-
Size
72KB
-
MD5
2ef423c28d6a7ca5225758956f6f9cc0
-
SHA1
3775fc86668225ea4dbdba17e9d2961e28bf4c99
-
SHA256
f2705a9893cf5e950c8c64edcc57eb48c0b35dc8686f9623a470b39a8388b81a
-
SHA512
6cd5cb8c93f68e023e62e2fd42d9f8dae39e1871dbfa844dc9888755d42cc612c33b307fcf59effe7e13c6aed82e4875f266f45b2223d96ce58a4a2d82b9976f
-
SSDEEP
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitA+9HeNs/adCE:qKtfDwsjPThTYszDH2fJeNsyb
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2188 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1452 Logo1_.exe 2484 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2188 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1452 Logo1_.exe 1452 Logo1_.exe 1452 Logo1_.exe 1452 Logo1_.exe 1452 Logo1_.exe 1452 Logo1_.exe 1452 Logo1_.exe 1452 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2188 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 28 PID 2080 wrote to memory of 2188 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 28 PID 2080 wrote to memory of 2188 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 28 PID 2080 wrote to memory of 2188 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 28 PID 2080 wrote to memory of 1452 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 29 PID 2080 wrote to memory of 1452 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 29 PID 2080 wrote to memory of 1452 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 29 PID 2080 wrote to memory of 1452 2080 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 29 PID 1452 wrote to memory of 1080 1452 Logo1_.exe 18 PID 1452 wrote to memory of 1080 1452 Logo1_.exe 18 PID 2188 wrote to memory of 2484 2188 cmd.exe 31 PID 2188 wrote to memory of 2484 2188 cmd.exe 31 PID 2188 wrote to memory of 2484 2188 cmd.exe 31 PID 2188 wrote to memory of 2484 2188 cmd.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a4827.bat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:2484
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
614B
MD51b1d98545cc0ed9fc473b509f72e0c2a
SHA105376351e6458c3b8b35f31484c763f10e96c253
SHA256c49dd3845c54ca8fe5c31a87d5ffc81745c72771bca020fcf2c9ee6130c35444
SHA51286855896d3502e2fec54928b5c68388095999f23b52408eef01a6d64b47492bfdbe5ed8d16b1979e6d830744907410e6f4b5dfb4fe87aa5811796b8477ea59f3
-
Filesize
14KB
MD5ba1b6a53a39813b496b80764332e72a9
SHA1103c9d243f93bc8707e1929ed270c1b51f93710a
SHA256c1d72b7640e81afb523db79b1e62763d21b78da7a44ea7793983cd56d1c531d5
SHA5125d8c426f501c0da5af9d512fd9da3df8742dc9aa487aa8abc2508a122a2d642e5b23b056e9f880b4c0ec387d9f30d737d9218764612c911849b40f55d87842ac
-
Filesize
58KB
MD5d075927cfa06e31c4e51e0cb20c8c613
SHA1a21bdc6c68b8d6bbce368c225ef0d293f3cd57ac
SHA256dde5e471f0ffd39b1fe0a3fd342c699f9b585c8a80b691502302322e62c8cd77
SHA512405448ab523521fb62c1d56cdda7ca5053e0b6499e5ea37092e8957596e13f423e99319b5f97a5da3c3e96408af58b123da957dc6332a3036ca5478c6b4e9ff5