c41f90de02591ea3a5b9af8b23ca29c0d3655c0b5ff24a04187f57d865289278

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
Size

1.8MB
MD5

ed08f517587fcf1b040d66c410734598
SHA1

acad3d78e2ce56ccc1a79e199218bb26d4713676
SHA256

c41f90de02591ea3a5b9af8b23ca29c0d3655c0b5ff24a04187f57d865289278
SHA512

a487e404c85cb7fbae0dac5d7935db1e521be773dd3e75a32033f3022462914214f543db971e6386c0004c44636a77749eb12b54a5fe39074ee2d146201cfcb1
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHZ:SCqm2Jpr0nNM7Dus7Nx25

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3176-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000228b1-5.dat	upx
behavioral2/memory/3176-650-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jvm.lib	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.exe	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms	ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
1f2b1d6b7e6196f601c714282d3d82ee

SHA1
127635a29186d0e3440fb67299ebb9a7f112cc19

SHA256
12cd40c6959d3308f2629ad1d2b9620a0112715b3a043d1b59ddc02aba8677cd

SHA512
c1a0a7ecf701db03430125c6f5256f6b8de26b499e41baac9355dea01e6dd19a028a8d3174b7dfa108ff4d06c16ad324e82e2dd1663a9053f28e7bd1c2dffddc

Download Submit
memory/3176-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3176-650-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads