Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
28/04/2024, 14:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe
- Size 2.2MB
- Sample240428-sbvlqaac89
- SHA256 d2d78552cbe164a02fbcd0388f087650e271b065118ffa0fd2011b810baf07b9
- MD5 0572a46d73db8019047e5fef73fbff21
- SHA1 c2a4040be3c7b5aa32f344cdcc46277bf1d8868d
- SHA512 eed1b0dbbe94fa3b4e8e378053f5005308c50f1aa646942cd6efbea688646290d0762ef64e6ebc56ed54d934f1924cfaedc4a69e5f735b799be59190ed2beb52
- SSDEEP 49152:bmzniAC7yvKHzvsC/Hw0nwCfE4nn1L1k9FaUUGfhq4tsYdR19sWu+:oJzQvsC/Hwkhcw1Rk9lf3sW/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX62E2.tmp 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\sIRC4.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX62C2.tmp 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX62A2.tmp 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 0572a46d73db8019047e5fef73fbff21_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\jarsigner.exe
- Size 63KB
- SHA256 333a99e9cbdc82277d3d2aa534cc906a20ab0f35a652c665710256f366b44c36
- MD5 1fd8c6d2fc98023be919aafbcb473663
- SHA1 0ea0a7c0bb811e7a815ece38f907c77e14cba5f8
- SHA512 9c71d5a5e7af71dd86d19588b1363cb22e726bf8bc86940d475379ffe1c440ecf7169e08ced3b33fd4a64660273831a8023e2f92036582280f6bb69f0fad87b8
- SSDEEP 768:V+aiqH1sziGJLL6iiaGNZ7KmA2UMSwBfNrGxnT0BrjqstFiwADKakU1erbQ1JaGJ:IaiqH1s+kCtrA2UMT0mTFibDKa1Xoha
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xdccPrograms\7zG.exe
- Size 2.2MB
- SHA256 d2d78552cbe164a02fbcd0388f087650e271b065118ffa0fd2011b810baf07b9
- MD5 0572a46d73db8019047e5fef73fbff21
- SHA1 c2a4040be3c7b5aa32f344cdcc46277bf1d8868d
- SHA512 eed1b0dbbe94fa3b4e8e378053f5005308c50f1aa646942cd6efbea688646290d0762ef64e6ebc56ed54d934f1924cfaedc4a69e5f735b799be59190ed2beb52
- SSDEEP 49152:bmzniAC7yvKHzvsC/Hw0nwCfE4nn1L1k9FaUUGfhq4tsYdR19sWu+:oJzQvsC/Hwkhcw1Rk9lf3sW/
- MD5 SHA1 SHA512 SSDEEP