dca444bb2b4605bb6d78d5f950a1d87fab8fcb3bf980413d6674f6c804454b95

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
Size

64KB
MD5

01aec7ddd59b584854154228d984e014
SHA1

0e0f34a1a192acb109d065684aff9805803792c1
SHA256

dca444bb2b4605bb6d78d5f950a1d87fab8fcb3bf980413d6674f6c804454b95
SHA512

3fa56d67e09ec6edfcaae7079fd915f30b11eae023724955d8d759f81095f1f7b35f375aab379ef0dbebe030a03278dbdfaa8c50654ed0c8935dfd598047c7e9
SSDEEP

1536:KsyqFgqQBn6oFOnpCglOr4seX/MQD8ps9/72Tb95vU841:KJfBnlOl+JKQs1ujU841

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\avp.txt	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InjectDLL.dll	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsystem.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xpsystem.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1220	2512	01aec7ddd59b584854154228d984e014_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\01aec7ddd59b584854154228d984e014_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\01aec7ddd59b584854154228d984e014_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\net1[1].htm

Filesize
88B

MD5
bcd8edb015ddc9e31e8e1b4657c3df43

SHA1
d320e044bc0ed73e557a885a1a47714b8c85200e

SHA256
37646c67c0e8429e6fbfc56678a20fd311cb48d0cb19bb5097078968f0673f37

SHA512
2a1497b35930c516a0f5bf75be460eff986b08d2ed0331dd702be5533b88198a59a41f39252809ef83b455bcf4d07ab0d9723494e8008a9578d0509a643cd6cc

Download Submit
memory/1220-15-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2512-96-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-37-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-93-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-105-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-268-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-269-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-302-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-325-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-330-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-331-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2512-388-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download