Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 22:20
Behavioral task
behavioral1
Sample
fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
fb4b1a227b33e90123c4fe121b2823b0
-
SHA1
eaf9c72a92c25f49dc7993606897f12edbde461e
-
SHA256
5ab226ffa1bc36e15897a194053adfbfddb1f0c4e0fd1e163a189979b5f050cd
-
SHA512
feb043332d2d66e8fd2cf6bcd9213be1f40695f4a666cb3fe8e6ebe554abbc09c20c51f064f651f299c91d76dfad7edef7514eec00602074807cd0063722fbf2
-
SSDEEP
24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqL:SCqm2Jpr0nNM7Dus7NxO
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/files/0x00090000000143ec-5.dat upx behavioral1/memory/2364-2581-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral1/memory/2364-9210-0x0000000000400000-0x00000000005BA000-memory.dmp upx -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Chess\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Manaus fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.exe fb4b1a227b33e90123c4fe121b2823b0_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD513d94de5221a91bb433fcc784f1408a3
SHA1890cfc76f7871d243e5f28007b9411b451f290be
SHA2562cf6e9ee5cfea1512bf82ba5251be65c2c2fdeffa3a3e725d07f69e7577efcf5
SHA512bd67242e7feb1c89d7528a74814413232c635a5b93717551508128e639d13e68f271dbf7eb0a5de6c06a686248d21a85bc07964ad1e6bb30961f435768718adc