Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 08:52
Behavioral task
behavioral1
Sample
ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
ed08f517587fcf1b040d66c410734598
-
SHA1
acad3d78e2ce56ccc1a79e199218bb26d4713676
-
SHA256
c41f90de02591ea3a5b9af8b23ca29c0d3655c0b5ff24a04187f57d865289278
-
SHA512
a487e404c85cb7fbae0dac5d7935db1e521be773dd3e75a32033f3022462914214f543db971e6386c0004c44636a77749eb12b54a5fe39074ee2d146201cfcb1
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHZ:SCqm2Jpr0nNM7Dus7Nx25
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3176-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x00020000000228b1-5.dat upx behavioral2/memory/3176-650-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\README.html.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\ko.txt.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\br.txt.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\hmmapi.dll ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jvm.lib ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.exe ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed08f517587fcf1b040d66c410734598_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:2928
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD51f2b1d6b7e6196f601c714282d3d82ee
SHA1127635a29186d0e3440fb67299ebb9a7f112cc19
SHA25612cd40c6959d3308f2629ad1d2b9620a0112715b3a043d1b59ddc02aba8677cd
SHA512c1a0a7ecf701db03430125c6f5256f6b8de26b499e41baac9355dea01e6dd19a028a8d3174b7dfa108ff4d06c16ad324e82e2dd1663a9053f28e7bd1c2dffddc