8bb68cbdbd34549e7c9b481efa78222ef6fcadcd05ff8a79e3141f1c4d92048c

Analysis

max time kernel
23s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
Size 934KB
Sample240404-khbhesba55
SHA256 8bb68cbdbd34549e7c9b481efa78222ef6fcadcd05ff8a79e3141f1c4d92048c
MD5 b3ad5df0d0d8c8387d773dbec2d7ae19
SHA1 97514769daab73996092c6d6d4f550efed071753
SHA512 26832ecfb253974b6f1caec437fe30ee5511cfc7d46b50e9391ec9674d59be4e9d2cb099f80f9efd962da1a64b933e35fe1cd3b1e071a33ac553a4c0b83a6ed3
SSDEEP 24576:I8lkYZwMfqQzQq2oBrjjkOMrhrEGOivIm:I8lkYZwazQq2YhkEGOivD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1884	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.usa

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\UsaShohdi.asu	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaw.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javaw.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javaws.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File opened for modification	\??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.usa	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1884	4800	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe	85
PID 4800 wrote to memory of 1884	4800	b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.usa
  C:\Users\Admin\AppData\Local\Temp\b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.usa
  2⤵
  - Executes dropped EXE
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.usa

Path C:\Users\Admin\AppData\Local\Temp\b3ad5df0d0d8c8387d773dbec2d7ae19_JaffaCakes118.usa
Size 835KB
SHA256 dc1ba9cb15d0808dc2d80ce13acfa0b07acdfcfe2cdf94da47e0e570e7345f6d
MD5 e015a2d8890e2a96a93ca818f834c45b
SHA1 30bda2b4464b1c41210cba367e444aed56502360
SHA512 20a80b50486e938b92f3aef85e59307f644b69dc5d1edee38038182b57caf636f5f1909959f6fafcfc2e915010d2b3d230cba8300fbc0f63ee2ee3ad8ad64123
SSDEEP 12288:dwrnIfqrQVGcRu612QHBrjjkUX1+VbFlzrSACGOi68dG9TWRzS:dwMfqQzQq2oBrjjkOMrhrEGOivI
MD5 SHA1 SHA512 SSDEEP

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 934KB
SHA256 8bb68cbdbd34549e7c9b481efa78222ef6fcadcd05ff8a79e3141f1c4d92048c
MD5 b3ad5df0d0d8c8387d773dbec2d7ae19
SHA1 97514769daab73996092c6d6d4f550efed071753
SHA512 26832ecfb253974b6f1caec437fe30ee5511cfc7d46b50e9391ec9674d59be4e9d2cb099f80f9efd962da1a64b933e35fe1cd3b1e071a33ac553a4c0b83a6ed3
SSDEEP 24576:I8lkYZwMfqQzQq2oBrjjkOMrhrEGOivIm:I8lkYZwazQq2YhkEGOivD
MD5 SHA1 SHA512 SSDEEP