08e78d133f6940936eb07a814e081b2574b80aeedab505adb44fbae56f60d203

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
Size

190KB
MD5

409e9756d390cb70cf307696c3e853a9
SHA1

17455caaa2a3b28a54a2a2bd08ce02090bc561c1
SHA256

08e78d133f6940936eb07a814e081b2574b80aeedab505adb44fbae56f60d203
SHA512

cee8533f452efd33ec4ed070503def4663e34d0793f9b22ef7056170260959f63c8e1c3b3522a19b45061b50857c0b0169cab3afbe8d76089c0e90499beaa255
SSDEEP

3072:+nymCAIuZAIuYSMjoqtMHfhfzKRIZ48MhZSIC38vOWSmBXdWM2M:JmCAIuZAIuDMVtM/KlOW3WM2M

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5108-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b35-2.dat	upx
behavioral2/files/0x000800000002295e-6.dat	upx
behavioral2/memory/5108-1564-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sw.pak.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ur.pak.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome.dll.sig.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe

C:\Users\Admin\AppData\Local\Temp\409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe
"C:\Users\Admin\AppData\Local\Temp\409e9756d390cb70cf307696c3e853a9.jaffacakes118.exe"
1⤵
- Drops file in Program Files directory
PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.tmp

Filesize
190KB

MD5
76c5309210a1f84f6ca9e964f0d37743

SHA1
82c1aa2ae79e7f767ab0691ecc69a4e466fd1cc6

SHA256
99d5fcd06a9a0998e76007c5f28d31b0c6ef3502377e75eda2d04fd2ed6cbca3

SHA512
57bcc52c0b12a606992aa2c5333dfd10340aebfd731efe3e66671284afec86c51b425250fa248e9cee2190d665e2a5cb8ff379c1c6b007c1addb089019b6786d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
289KB

MD5
448dce94b2cfb8dccc01b4fdbb21acd1

SHA1
fdc52768a48a5ced51357d4fcdf32a3a7f0d756c

SHA256
405985592d181dfb376aa8f0388878e2887a2b18dc6504830a4f6e2ee2f8ab7b

SHA512
54ded3ae297f50afef8b9d9d4f830eb6d3bd3c4ed7e1e8b58e12798e752710ab91c5d2d1b60f15a438cc2992f68f3b4e3f9c0e779104d443ce0018d68a4e4888

Download Submit
memory/5108-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5108-1564-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads