8ddece0348a4cb5ce5aa8f316f0fa578dc5adabf03bec1b7dba04a41b1d2c8d0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
Size

1.8MB
MD5

fdb6f834e6fc51bb904fcc05f50afb5c
SHA1

987d6174991826fbf8aed674b3bc848d723a1313
SHA256

8ddece0348a4cb5ce5aa8f316f0fa578dc5adabf03bec1b7dba04a41b1d2c8d0
SHA512

5f3eb7de5a55964795aee58acef381d87f2a21eaab7ac9ae77fd210ec1060bfd08b477bac9a7773e06575640d33322b684fb4cd3e93236fbb5cd706539e16ffd
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7NxqUkHs7:SCqm2Jpr0nNM7Dus7Nx2S

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2372-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x0001000000022aa2-5.dat	upx
behavioral2/memory/2372-5429-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/memory/2372-14070-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Program Files\desktop.ini	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\3DViewerProductDescription-universal.xml.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-200.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Cloud.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSPCL.TTF.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Planet.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\inktotextengineimm.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-250.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-white_scale-200.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_EyeLookingUp.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-black_scale-125.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxSignature.p7x.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-96_altform-unplated_contrast-black.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\Email.ot	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-200.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\office.js	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-150.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_In_App_Notification.m4a.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\skin_en-GB_female_TTS.lua	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\wefgallerywinrt.css	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\MicrosoftAdvertising.ini.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_DiningReservation_Light.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-150.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-white.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-200.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-100_contrast-white.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-100.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200_contrast-black.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTree.v11.1.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Planet.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-60_altform-unplated_contrast-white.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseControl.xaml	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\LivingImagesProcessing.Windows.dll.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-100.png	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-200.png.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.exe	fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdb6f834e6fc51bb904fcc05f50afb5c_JaffaCakes118.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.8MB

MD5
739d6f23ef9ef683165048a0847e9914

SHA1
0d126efdfe220bccbb3c70f228e6662d074ba5b3

SHA256
27cbc9a2af8c50956e50383cb8f30de94375a509883c1cc38fb0274eb96a67e1

SHA512
ef9013b7ba12aaec7fa25ff37a34eb8dcc9a08b267b024384e7c6776818f2cfa0a9723dded9acbbabcc07a0642da098c10cc746fa3642d9d9e73589a86186289

Download Submit
memory/2372-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2372-5429-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2372-14070-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads