Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 09:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe
-
Size
1008KB
-
MD5
09819a171625f8093aeeadbaf3249297
-
SHA1
7c61b31d1db1be6488427f5c2618cf3c1386e0e3
-
SHA256
cdea6f598c69055bcad81702e21e4234e4d1d4da1c126e615d0c108114c3abc1
-
SHA512
0fd3a3a29a5c1a030f006d26b3647154b23784c12a5871eee2317ea9aacea731ce6809bcbaa9784ef6aec905907e5bf80b75bce4edd0ff8633786449cf112a37
-
SSDEEP
24576:91bnLJ/R9RGG07qBd+65DVJ8Zxyt8/gzF0:9hLJZ6RqBdb0xyt8YzO
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\sIRC4.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\dotnet.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 09819a171625f8093aeeadbaf3249297_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD57bbed67be94386bf37b26aeb5bc3e412
SHA17f2ba82380b03a20fa431cc432319b29de902c35
SHA2563317b72b50d789baa66d27b4888fbdce0d3c43040d29a080a3922da84b3b66ff
SHA512520f3e8d8c67092acd4e356ef3805431b045dfe075cfaa58d4904d0b0ddc52a4e4a24cd8f2b91b951f01d73e0c8f1644770d93a3d9eedc38fdeac6c6f4f4dd3f