8a365fa959369919af757b979ce20fa868b939d7d784101c4432b524f07a0363

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
Size

85KB
MD5

8472b271cb10bb7cf7514049b898d9c3
SHA1

cfee246a5dea2bc34f61b54e04ccf835a075f0d8
SHA256

8a365fa959369919af757b979ce20fa868b939d7d784101c4432b524f07a0363
SHA512

9ce9988f854995091be78bfa71773e9874e5d14137a2823135ecc3e3301238ebe93054c05e10c9c624127bf6b1fb7500b4d19f20ea8e1025086787fe19f64ada
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q4xFrphgi1k:+nyiQSo+hgf

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3505) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3024-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c000000015cce-2.dat	upx
behavioral1/files/0x00030000000104b4-6.dat	upx
behavioral1/memory/3024-646-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\settings.css.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\MpAsDesc.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\flyout.css.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll.tmp	8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8472b271cb10bb7cf7514049b898d9c3_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
86KB

MD5
bf73bf0269a3a4fa8a03c1946a7007af

SHA1
1fb2d927373b026dec6d822942c79116f44ec774

SHA256
90b01706bba1e9b3c05a1c52234d8d3bdf36bd7c2cd5c763d1b489f2e4f78d1a

SHA512
9da6eca7ea65604271e1ef8d25ffacabfa0c148c5af13970014bc377f08cef83899347f01f1f8cd6a625ecd6362cac4f83b4671a7cfb429157d67365ed99be6c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
1a02782af86a5115a1a5cb256dbf5405

SHA1
75d1d7a5ec692617efe49ed96e5187725156593f

SHA256
4c317757409a2cc893f09b8362051043d00136f1b746d56d2a19a1665103e355

SHA512
c02fe85794c0a8ffe0fbf2ddc696f45b697479446b73bfa0c384b2c722bd3475d40ac7acf7737d9964f1829a046215a8a6eb0ad0b6cf347bac32a0023a978541

Download Submit
memory/3024-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3024-646-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads