d506c3c2af6ed94f3d2eeeb332d78e4e77c84d3dc86d9338fd97bf87597c3e26

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
Size

675KB
MD5

021af1dce26cae9efe3dd5ff6277c9d4
SHA1

1a4753be41aefdbfd971cb75719abca980fb2337
SHA256

d506c3c2af6ed94f3d2eeeb332d78e4e77c84d3dc86d9338fd97bf87597c3e26
SHA512

e37ce9a72c9cb051b61b8b5242ba4daea4ac9d3c434b1807c8222a430cb091fd9df4a37ecc9bcd1f5df5df04b5fcfbc9b6de25b114d767c579f511f2b25cf6de
SSDEEP

12288:JlsnKswuJyxeOnnz31HsKUhFycn+7CnE0gAG/qcUypHlzzsif/D3MDY35cMe+6yN:vsnKsbynzFHcIcy0gAGCUzzsB83O6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1400-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/files/0x0029000000015c2f-5.dat	upx
behavioral1/memory/1400-991-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-993-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-1935-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-3440-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-5008-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-6349-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-7485-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-8506-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral1/memory/1400-9200-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoAcq.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\CET	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Asuncion	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.exe	021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\021af1dce26cae9efe3dd5ff6277c9d4_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
677KB

MD5
0efe9f1b15a5a66ba1db07d54906795d

SHA1
a8671efc75dc534ceca7997a6e62dd8ee805ffc4

SHA256
aadcccbd6c21b454883a2751dddb51de80b0e85dcb56d2c06a10f1bcdc7b46f5

SHA512
b90d9afeec1501523429bd6b844335168ebc140b551abf9b49b5d55570d024ff6f255793b2da6b788ccbb7d043a5033d912e90be2304c79e163bee5505d0de5d

Download Submit
memory/1400-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-991-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-993-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-1935-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-3440-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-5008-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-6349-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-7485-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-8506-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1400-9200-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads