4abb35e5944b475cc482b708d89020e46faf815f6d5887974044aabc4d4c7a02

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
Size

2.0MB
MD5

f471df29e1c77846b3afd920b50c6477
SHA1

de9e3028d9d5dd550e2097221cc5611e6cd8867b
SHA256

4abb35e5944b475cc482b708d89020e46faf815f6d5887974044aabc4d4c7a02
SHA512

6fc30d5a8f9a59e58939f2e7c70f5bde8dd4de5e5fc036a173018e8fbf8aade29bf77fa6119edd10f2397bccc8963338fdb367a1fb14f4c7ce1b7e1cdda05ab9
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHE6pQPN:SCqm2Jpr0nNM7Dus7Nx2kCqN

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1508-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000022ac6-5.dat	upx
behavioral2/memory/1508-4920-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/1508-12467-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\desktop.ini	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewCalendar.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-100.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\In.Tests.ps1	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Wide310x150Logo.scale-100.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-24_altform-lightunplated.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_WorriedEye.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-24.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-125.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-125_contrast-white.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-125.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-125.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEWSTR.DLL.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Medium.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-white.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.Controls.winmd	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-30.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-400.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Pyramid.Medium.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-150.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-125.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es.pak.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-250.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\no_camera_dialog_image01.jpg.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_DogEar.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated.png.exe	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page2.jpg	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-100_contrast-black.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.Debug.dll	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\avatar310x310.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-400.png	f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f471df29e1c77846b3afd920b50c6477_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
2.0MB

MD5
b343b9b1a8437bae072b56fe72668d44

SHA1
97558a8de711ecb1effbab6a74d193a7985ffba8

SHA256
275ca0c766da02f91fc804a5b8f39f502a811e6f1589cd69abf2a3236c9da437

SHA512
b693ebe9ccb8e820ad237319e100afe057d9f667c4b86334b591b3e113a8999248acb719f62522c75803c82083996554ef8f209f550b9fddf732586330ef58bf

Download Submit
memory/1508-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1508-4920-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/1508-12467-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads