Analysis
- max time kernel
146s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe
- Size 213KB
- Sample240404-p3mteagg96
- SHA256 156f276b8f252f669aaf57851be098570ebd7b1317f9571d495a707edc33fe25
- MD5 b8c921f75c6d4d24818ad6171628f922
- SHA1 08453176a0eca5c92e29d22fd333150b782095d7
- SHA512 15962da73a5009fd2e741ae91e106341b2cd61fe534254d6ca5c46956f79172cd6b2ac6f3d69ae61bdf86e0d6417c306ea862278fc8f9b682d29a58484a7264e
- SSDEEP 6144:Q731bdBaB7/RFW9jgrFPJVFU/zElctSB2fklIEa:C1bIRFjxxI/4ctSsk5a
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXB585.tmp b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXB5C5.tmp b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\dotnet.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\MavInject32.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MavInject32.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\sIRC4.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXB5A5.tmp b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\createdump.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe b8c921f75c6d4d24818ad6171628f922_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\RCXB5A5.tmp
- Size 62KB
- SHA256 021e5925c604085e83fa469394d54980eef8037b6767a8ed1e223149cbd7c3c8
- MD5 69cf37104e6ef43420e25df19337c76c
- SHA1 18b9c668ae6880368148509dce841768ea7a4e8f
- SHA512 76b1c92b1e6a8d85d7dc16930ae8df19120a351d0594f007fd102b501f11b4c56f279ff465230543b6a3da82b23664154cb60992534b16847addde5f17931977
- SSDEEP 768:0+aiqH1sziGJLL6iiaGNZ7KmA2UMSwBfNrGxnT0BrjqstFiwADKakU1erbQ1JaGR:vaiqH1s+kCtrA2UMT0mTFibDKa1Xohm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xdccPrograms\7zFM.exe
- Size 930KB
- SHA256 c7575021116e144315d5ad074169fbd001d13ea16eeb36f1cde20f6566be26e1
- MD5 23b08f1c7a2efd4981883bb47cf54798
- SHA1 b6cc8bd07a3162c79c076f4c3554d85f0ed5c85c
- SHA512 a062292ba732cd83afdf42676964f2462174cb09af04395cf7a2bb67558f766cb12de22b25de634f19065c731831e97b3842d7543df5d121496c8f0df8635daf
- SSDEEP 24576:C1bIRVx2FhjDyvp9bhhxfmJXTr8Rg/FW3RC4PRd:CGfx2FFGvvh8BW3RC45d
- MD5 SHA1 SHA512 SSDEEP