Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe
-
Size
72KB
-
MD5
2ef423c28d6a7ca5225758956f6f9cc0
-
SHA1
3775fc86668225ea4dbdba17e9d2961e28bf4c99
-
SHA256
f2705a9893cf5e950c8c64edcc57eb48c0b35dc8686f9623a470b39a8388b81a
-
SHA512
6cd5cb8c93f68e023e62e2fd42d9f8dae39e1871dbfa844dc9888755d42cc612c33b307fcf59effe7e13c6aed82e4875f266f45b2223d96ce58a4a2d82b9976f
-
SSDEEP
1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitA+9HeNs/adCE:qKtfDwsjPThTYszDH2fJeNsyb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1456 Logo1_.exe 3028 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe Logo1_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_92812\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe File created C:\Windows\virDll.dll Logo1_.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe 1456 Logo1_.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4356 wrote to memory of 4800 4356 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 85 PID 4356 wrote to memory of 4800 4356 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 85 PID 4356 wrote to memory of 4800 4356 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 85 PID 4356 wrote to memory of 1456 4356 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 86 PID 4356 wrote to memory of 1456 4356 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 86 PID 4356 wrote to memory of 1456 4356 2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe 86 PID 1456 wrote to memory of 3456 1456 Logo1_.exe 56 PID 1456 wrote to memory of 3456 1456 Logo1_.exe 56 PID 4800 wrote to memory of 3028 4800 cmd.exe 88 PID 4800 wrote to memory of 3028 4800 cmd.exe 88 PID 4800 wrote to memory of 3028 4800 cmd.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD532.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ef423c28d6a7ca5225758956f6f9cc0_JaffaCakes118.exe"4⤵
- Executes dropped EXE
PID:3028
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989KB
MD5668161a8db7b3d352802d15a1595e33e
SHA13b48f6fd125b3574c9c420aa02b09c931c80283e
SHA2563665eebfcbb8f7bebf2759d8ec427501cb721c0fd8501174bedce95b35bdbe09
SHA5123a5301af0165879af4f7df93657a3c64eb8d07d397e9a301c290d039b595c205b8fb5c9a78cfb9df3a76ee88c2326affaa29b704fa17b7e84d95de9c51f7a7e7
-
Filesize
614B
MD563e6b76615fb005c36ce4b4be3f8ff6b
SHA120a988f56b200fe0593739aa094f620fe5d5005d
SHA256f31215a137263626989b61f922e17ac2b648314fd0e8b0dff8ad571a6b6fa0c3
SHA5124b480bae3fbd511ff904fbe769e6c8051d79491a99df3444da6fd64329a11be690c69be251c6aa8ed881de956043496283605211c59145602a73d5fc32228cae
-
Filesize
14KB
MD5ba1b6a53a39813b496b80764332e72a9
SHA1103c9d243f93bc8707e1929ed270c1b51f93710a
SHA256c1d72b7640e81afb523db79b1e62763d21b78da7a44ea7793983cd56d1c531d5
SHA5125d8c426f501c0da5af9d512fd9da3df8742dc9aa487aa8abc2508a122a2d642e5b23b056e9f880b4c0ec387d9f30d737d9218764612c911849b40f55d87842ac
-
Filesize
58KB
MD5d075927cfa06e31c4e51e0cb20c8c613
SHA1a21bdc6c68b8d6bbce368c225ef0d293f3cd57ac
SHA256dde5e471f0ffd39b1fe0a3fd342c699f9b585c8a80b691502302322e62c8cd77
SHA512405448ab523521fb62c1d56cdda7ca5053e0b6499e5ea37092e8957596e13f423e99319b5f97a5da3c3e96408af58b123da957dc6332a3036ca5478c6b4e9ff5