Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:17
Static task
static1
Behavioral task
behavioral1
Sample
03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe
-
Size
799KB
-
MD5
03c0158479dc2353ce33cd0b1ae14ce4
-
SHA1
89702438246caa63aefdfd7b589c25bfe6e893c0
-
SHA256
546b8ec7e53888efcb62641c0c314d43e263b4180e4ad539bd36bc3e7657c1bb
-
SHA512
11ef2e0dec41fb698a169bacb844d8efbd8477301a6c71576b493cd1c1bd865e75137b76088e4523c85173701dba29210cd0493b3d6f3c240b4ed8518a5e377d
-
SSDEEP
24576:91bNWDNJ52BazRnbQSx4p+0/vzm0mTOwlqn7+LhS:9jW/5DxG3zOO57IS
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX4714.tmp 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\DebugUnprotect.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DebugUnprotect.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX46B4.tmp 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX46D4.tmp 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX46B3.tmp 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX46F4.tmp 03c0158479dc2353ce33cd0b1ae14ce4_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\DC++ Share\idlj.exeFilesize
111KB
MD55d451fef23e42c1e4dc7aa149f59df42
SHA16664bcdf072f48a00f5b5c14fad892609bd9fb72
SHA256dd9fe5184e8cfdb9e38c5881e1d5dce645ed664dba82f5844b41995a9071d2e1
SHA512314effe0d116bdbfeca629a52b1ee1d08992cd9e5d2e3aabd2bd20e603020af58f7de8ac269c5fe8a38918deb0254951d9eb65b94f363367a4850ab0eec85171
-
C:\Windows\SysWOW64\xdccPrograms\7zG.exeFilesize
834KB
MD509b029e0cc99003c6c384a646904da05
SHA10525508ea6ee38eeeff9457b62f8c9a9efe4e6e3
SHA256df87042009b45e213b29d095535b654f675667502086a8155d4279a35b166f61
SHA51211af3cf9feb31014bf75872582a4cf3f6e51221ea9c7f166e2a8311b53fd60f29a563199479ac0dfdf11c9c1dd37713681c1b053eb232babbb7f48e0ade58fdb
-
memory/2184-117-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-118-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-113-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-114-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-115-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-116-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-35-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-112-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-119-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-120-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-121-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-122-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-123-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2184-124-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB