Analysis
- max time kernel
127s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
19/04/2024, 23:39
Behavioral task
behavioral1
Sample
fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe
- Size 1.8MB
- Sample240419-3nca1sbd3s
- SHA256 2bc4126ca5158b1ad6983ada038f0cb0b7ce19e4495d4a952704e2499edd2661
- MD5 fb6c808a4dd54e789aed8048c06771d7
- SHA1 f94cd65b14e7664d1551cb5529ed97568c43c3b5
- SHA512 49612b67c9edcf629bc3ec5a974945edb9beb8cd8852ee4904b7646bd1e8e60e5bd3ec31631cc91efb1623571638d584ecb979ef53f20f57baac0858deca0d61
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkH3:SCqm2Jpr0nNM7Dus7Nx2X
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3928-0-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/files/0x0001000000022ade-5.dat upx behavioral2/memory/3928-6009-0x0000000000400000-0x00000000005BA000-memory.dmp upx behavioral2/memory/3928-13738-0x0000000000400000-0x00000000005BA000-memory.dmp upx - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\desktop.ini fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\mfc140kor.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-unplated.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30_altform-unplated.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_BadgeLogo.scale-200.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\MediumGray.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-200.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\PREVIEW.GIF fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\chats_emptystate_v3.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Dismiss.scale-64.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48_altform-unplated.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.HCBlack.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-100.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Cng.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-150_contrast-white.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-200_contrast-black.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sw-KE\View3d\3DViewerProductDescription-universal.xml fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-150.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-black_devicefamily-colorfulunplated.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare71x71Logo.scale-100_contrast-white.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\SmallTile.scale-200.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\resources.pri fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-200.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-200.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\TellMeOneNote.nrr.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-96.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-100.png fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\7-Zip\Lang\ps.txt.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-125.png.exe fb6c808a4dd54e789aed8048c06771d7_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 2b53f0ac903bee066e30a5030610657d4db701212ac09bc043a5071b877c6e36
- MD5 e83ae778d2607449b7632f3e1f654b11
- SHA1 8e2d503ca365882fda514f4714a08e2e9f5fc25e
- SHA512 2b5c72a5b0fe5a5159854b8d439996a372b0c1a255f8d5a45ba22adc569e236adf037bcce7a8adb88e8cdb6c131412c900d0b736089678bb9efb9ec67da1aabc
- SSDEEP 24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHu:SCqm2Jpr0nNM7Dus7Nx2O
- MD5 SHA1 SHA512 SSDEEP