Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 17:23
Behavioral task
behavioral1
Sample
e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe
-
Size
57KB
-
MD5
e8016aceca1babda75f08855f26a4787
-
SHA1
6854436e08ef5b4c98ce389e8498693a8a1d6443
-
SHA256
05119a6e306a5aa0a182e84ac46ff84972f704aac9b5807fd1fdbd14399ac362
-
SHA512
6e7c3db9d276fc64589ede2d36f84a3aa5e5d7b66f70781d8e3e5c3210cf15f9ff0a21e173ea9b6fd7feeccae3a768ae9d236ff47158333c85563dfc33820fa5
-
SSDEEP
768:j07c92/EyTAYtxqfGNC0klI7C8ycYlI5P194jp4Rzis2sUABytzaZa01/cl:g7wc1aGNC0klI7CPpIFa6ksWA06abl
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3096-0-0x0000000000800000-0x000000000080E000-memory.dmp upx behavioral2/memory/3096-3-0x0000000000800000-0x000000000080E000-memory.dmp upx behavioral2/files/0x00020000000224ed-7.dat upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ICQ 4 Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\WinRAR.v.3.2.and.key.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\Kazaa Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\Kazaa Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ICQ 4 Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\index.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Winamp 5.0 (en) Crack.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\Winamp 5.0 (en).com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\Winamp 5.0 (en).ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\Harry Potter.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ICQ 4 Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\ICQ 4 Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\ICQ 4 Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\ICQ 4 Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\Winamp 5.0 (en) Crack.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Kazaa Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\index.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\Winamp 5.0 (en) Crack.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\Kazaa Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\WinRAR.v.3.2.and.key.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Winamp 5.0 (en) Crack.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Winamp 5.0 (en) Crack.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ICQ 4 Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\index.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\WinRAR.v.3.2.and.key.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ICQ 4 Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\index.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VC\Winamp 5.0 (en).com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WinRAR.v.3.2.and.key.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\Network Sharing\ICQ 4 Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\Kazaa Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WinRAR.v.3.2.and.key.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WinRAR.v.3.2.and.key.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\index.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\Winamp 5.0 (en) Crack.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\WinRAR.v.3.2.and.key.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\Kazaa Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Winamp 5.0 (en) Crack.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\WinRAR.v.3.2.and.key.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\WinRAR.v.3.2.and.key.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\ICQ 4 Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\WinRAR.v.3.2.and.key.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\Winamp 5.0 (en).ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\Winamp 5.0 (en) Crack.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\Winamp 5.0 (en).com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Harry Potter.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ICQ 4 Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\Kazaa Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\Winamp 5.0 (en).exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\ICQ 4 Lite.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\Winamp 5.0 (en) Crack.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\Winamp 5.0 (en).exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\Harry Potter.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\ICQ 4 Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\ICQ 4 Lite.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WinRAR.v.3.2.and.key.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\Kazaa Lite.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\index.ShareReactor.com e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe File created C:\Windows\lsass.exe e8016aceca1babda75f08855f26a4787_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5e8016aceca1babda75f08855f26a4787
SHA16854436e08ef5b4c98ce389e8498693a8a1d6443
SHA25605119a6e306a5aa0a182e84ac46ff84972f704aac9b5807fd1fdbd14399ac362
SHA5126e7c3db9d276fc64589ede2d36f84a3aa5e5d7b66f70781d8e3e5c3210cf15f9ff0a21e173ea9b6fd7feeccae3a768ae9d236ff47158333c85563dfc33820fa5