c67f64a09f64cb218a870271bb4e2fd6379a0e2774fba72e9219db4793a2a72a

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
Size

1.8MB
MD5

e81b3d8425689013715fe7bd27d69c40
SHA1

bc49cde27ef84f4da568e78d645f606955fd4dd1
SHA256

c67f64a09f64cb218a870271bb4e2fd6379a0e2774fba72e9219db4793a2a72a
SHA512

8fd97feb6022d41ab513c4ca8a79edbee70a90cf65fc1303dfd57b499c2b52531a1d15fa7735c76512a087a3843414e04e58e023f4b666bc3010d0c4d796d41f
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxqw:SCqm2Jpr0nNM7Dus7Nxl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3116-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228a1-5.dat	upx
behavioral2/memory/3116-6386-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/3116-13467-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\desktop.ini	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\msointl30_winrt.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-125.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\search_emptystate.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.39f3763c.pri.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-200.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_altform-unplated_contrast-white.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\powered-by-foursquare.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-200.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-400.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-256_altform-unplated.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-400.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Xaml.resources.dll.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriLI.ttf.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\logo.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationClient.resources.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListNewNote.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-150.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\SlowMotionPage.xbf.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\EnsoUI\dashboard_slomo_OFF.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-125.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-400.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-colorize.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Primitives.resources.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-lightunplated.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-lightunplated.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Shield.targetsize-44_contrast-white.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-150.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\mfc140cht.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBUI6.CHM	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-200.png	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-white.png.exe	e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e81b3d8425689013715fe7bd27d69c40_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
034cdd24b48e3386b9e202ccc1306584

SHA1
cc66fb2490e5f4509703a3fa973a2c8628bb84f5

SHA256
d14e9334e46fb659b80f47c96f4a1fb8f62941a0fe9b98b3b06bdc1ca96f74e1

SHA512
62c7220992918d923ca6559af439e856e80830875952dc4643f6d1a948c31de0a416345a01d1ab0cfae4830fffa08660540a9e2095e4ce2215d201cc04f36649

Download Submit
memory/3116-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3116-6386-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3116-13467-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads