aa84f993e9b96cbc1e6ff42e577f22398c1c666b603d4b15b9b0803d97abc6e3

Analysis

max time kernel
94s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
Size

1.8MB
MD5

f6c064112b4ac90269f95398cc158adf
SHA1

c124e39758dd45026b59624a599abe490c7f6969
SHA256

aa84f993e9b96cbc1e6ff42e577f22398c1c666b603d4b15b9b0803d97abc6e3
SHA512

a52831ecf1a08e9f3df6a12c74c89ee46a7d769c6000f42aebbf936f1fa603b60763667c6310a0c5ef32ca1eb7facf5fb4d89dde27f71672c3f6790a89c5427b
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHm:SCqm2Jpr0nNM7Dus7Nx2G

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2836-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000022aa2-5.dat	upx
behavioral2/memory/2836-6290-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/2836-14068-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\desktop.ini	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-100.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-100.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-256.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-20_altform-unplated.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-white_scale-125.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_TileWide.scale-100.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40_altform-lightunplated.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-200.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\LockScreenLogo.scale-200.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated_contrast-white.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_altform-lightunplated.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-black_scale-200.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\CameraApp.Native.dll	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\FrameExtractorPage.xbf	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-200.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-64.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-125_contrast-white.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-white_scale-125.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-white.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-1132431369-515282257-1998160155-1000-MergedResources-0.pri	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppUpdate.svg.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-white_scale-125.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors.WindowsRuntime.dll	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-black.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24_altform-unplated.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-200_contrast-black.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\PREVIEW.GIF	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices.WindowsRuntime.dll.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EMLAttachmentIcon.png.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.exe	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-200.png	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxoutlook.exe_Rules.xml	f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6c064112b4ac90269f95398cc158adf_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
bd6673307763f90280d2cd94d7191e2b

SHA1
529f145c3acaea3bdfdc1ae01e5758ec2723ea14

SHA256
c766ce72cfc899521b8eda4843d8cd823e389af4facccc53e3197e34b5a640ea

SHA512
5dcbbf74ab4103710dea425cc900229d89ef12559738b0a9c36ea1e2e4441197e24320087095b04ff10ff6fa8651a5277b59a02991e0386c3505c455172daee3

Download Submit
memory/2836-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2836-6290-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2836-14068-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads