Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-10-2024 01:51
Behavioral task
behavioral1
Sample
54d303b283679409adb0d34f34573b60_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
54d303b283679409adb0d34f34573b60_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
54d303b283679409adb0d34f34573b60_JaffaCakes118.exe
-
Size
52KB
-
MD5
54d303b283679409adb0d34f34573b60
-
SHA1
864feb1110af470f84827ed198fff2a9435b21f7
-
SHA256
a23f28cc3a6e1718908506e8106d74649fee66776ba9c9a1d111e1fbc700fe2a
-
SHA512
699af970ecd5fdd50b7c2ac1229b199d4b8abe77aa4c827ccd871b7888eb93919798017e9489ae50682a62dfae4b15a34431dda826783e3f7cfb0ab9dfb669f1
-
SSDEEP
1536:cCM2LNW+RfAFqkuK9crRoj+tJC3oNRsVGtLytwO:k2pW+tAGKGRoOJaoNKAS
Malware Config
Signatures
-
Renames multiple (950) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2600 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Processes:
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2364-1526-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2364-1525-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2364-2296-0x0000000000400000-0x0000000000479000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
54d303b283679409adb0d34f34573b60_JaffaCakes118.exedescription ioc process File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Inuvik.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\postSigningData.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nipigon.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\meta-index.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Lima 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Eucla 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Boise 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Phoenix.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.txx 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\release 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
54d303b283679409adb0d34f34573b60_JaffaCakes118.exenotepad.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1680 notepad.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
54d303b283679409adb0d34f34573b60_JaffaCakes118.exedescription pid process target process PID 2364 wrote to memory of 1680 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe notepad.exe PID 2364 wrote to memory of 1680 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe notepad.exe PID 2364 wrote to memory of 1680 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe notepad.exe PID 2364 wrote to memory of 1680 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe notepad.exe PID 2364 wrote to memory of 2600 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe cmd.exe PID 2364 wrote to memory of 2600 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe cmd.exe PID 2364 wrote to memory of 2600 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe cmd.exe PID 2364 wrote to memory of 2600 2364 54d303b283679409adb0d34f34573b60_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d303b283679409adb0d34f34573b60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54d303b283679409adb0d34f34573b60_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\README_ASAP.txt2⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:1680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\54D303~1.EXE" >> NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2600
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a0bca63c8ba75cf1b7a30d0b171f474f
SHA1af8a8153d52ee5d471e7f69b2245683b441b7b7d
SHA256fdac2db3a1b1d199162e8768be32cc0c9e7161556b840c24c7e1928ac3f3f531
SHA5120d68622772132d80fda645fa7cbd45eed8cd5f876da359f4aa735c56adfca949f7b77843301d8f6da26e89ade67daa3341f2edf0d0bcde08599a362b1abdc002