Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2024 10:56
Behavioral task
behavioral1
Sample
5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
-
Size
11KB
-
MD5
5c493f9fb1c601a4aa76b695d4e00123
-
SHA1
62ef64de682fcb1f015c1e402888f7f070120732
-
SHA256
5403af9977fd94503913667d164e3a751e91e1d07fa67db01dc661219c708eaa
-
SHA512
9fd1a33e3cc7bb7f042840f5167746f260ca0b221f03af540b535b023b0eac01beda886cc336e0d013b62bf213a221567446c7d2390f46a5699e00df2e7d1ea7
-
SSDEEP
192:9/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMW3YN51:9ebFNw4Pk1itKkpAjjJs6B40WW3YNT
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe -
Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrome.7z 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p3.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation2.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_remove_tool.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p1.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p2.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialRotation.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\RoundedFreehand3D.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialSticker.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_add_tool.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_crop_handles.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Sticker.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\PopResolve.doc 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\FlatFreehand3D.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation1.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_Welcome.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\BlockSwitch.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Unipulator.mp4 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.ppt 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.ppt 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.ppt 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.xls 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.ppt 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.xls 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.xls 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.xls 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.$MTF\ = "QNZLEINWANSPJYX" 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\ = "CRYPTED!" 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\DefaultIcon 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mI3wNClH6fF8d8m.exe,0" 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell\open\command 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell\open 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QNZLEINWANSPJYX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mI3wNClH6fF8d8m.exe" 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.$MTF 5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c493f9fb1c601a4aa76b695d4e00123_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4960